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Give me an ounce of civet, good apothecary, to sweeten my imagination. 


—Shakespeare. 
(King Lear, Act IV, Sc. 6) 


Preface 


1. I wish to acknowledge my indebtedness to William F. Friedman in draw- 
ing upon portions of his early work, ‘Military Cryptanalysis, Part III,” for 
much of the material treated in Chapters I-V. Chapters IV-XI are revisions of 
seven of my monographs in the NSA Technical Literature Series, viz.: Monograph 
No. 19, “The Cryptanalysis of Ciphertext and Plaintext Autokey Systems’’; 
Monograph No. 20, “The Analysis of Systems Employing Long or Continuous 
Keys”; Monograph No. 21, “The Analysis of Cylindrical Cipher Devices and 
Strip Cipher Systems”; Monograph No. 22, ‘The Analysis of Systems Employ- 
ing Geared Disk Cryptomechanisms”; Monograph No. 23, “Fundamentals of 
Key Analysis”; Monograph No. 15, ‘‘An Introduction to Teleprinter Key 
Analysis”; and Monograph No. 18, “Ars Conjectandi: The Fundamentals of 
Cryptodiagnosis.”’ 

2. I also wish to acknowledge my indebtedness to Francis T. Leahy for 
keeping me out of statistical mischief, and to Bruce W. Fletcher for his expert 
assistance in the final proofreading, and for checking the cryptograms and the 
various diagrams. 


—L. D.C. 
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1. Preliminary remarks.—a. This text constitutes the third in the series of six basic texts on the 
science of cryptanalytics.! The first two texts together have covered most of the necessary fundamentals 
of cryptanalytics; this and the remaining three texts will be devoted to more specialized and more 
advanced aspects of the science. 

b. It is assumed that the cryptanalyst reader has studied Military Cryptanalytics, Parts I and If, 
and is familiar with the cryptologic terminology, concepts, principles, and techniques of solution of the 
various cryptosystems treated in those texts. This general background is a necessary prerequisite to the 
thorough understanding of the principles expounded in this and the succeeding volumes. Where appropriate, 
however, reference will be made to particular portions of the first two volumes; the reader would be 
wise to have these volumes handy when undertaking the study of this present text. 

c. The text immediately preceding this one dealt with various types of periodic polyalphabetic 
substitution, commonly called repeating-key systems. It was seen in these repeating-key systems how a 
regularity in the employment of a limited number of alphabets, or even the employment of a complete 
set of alphabets in succession as in a progressive alphabet system, results in the manifestation of peri- 
odicity or cyclic phenomena in the cryptogram, by means of which the latter may be solved. The difficulty 
of solution is directly correlated with the type and number of cipher alphabets employed in specific 
examples. 

d. Two procedures might suggest themselves to an enemy cryptographer for consideration if he 
realizes the foregoing circumstances and he thinks of methods to eliminate the weaknesses inherent in 
repeating-key ciphers. First, noting that the difficulties in solution increase as the length of the key 
increases, he might consider employing much longer keys as a means of increasing the security of the 
messages. Upon second thought, however, if the enemy cyptographer recognizes that, as a general 
rule, the first step in the solution of these ciphers consists in ascertaining the number of alphabets em- 
ployed, it might seem to him that the most logical thing to do would be to use a procedure which will 
avoid periodicity altogether, eliminating the cyclic phenomena that are normally manifested within 
cryptograms of periodic construction, and thus foil even a first step towards solution. In other words, 
the eryptographer might progress from the use of rather short repeating keys (of perhaps no more than 
a dozen letters or so) to the use of key phrases of, let us say, 25~40 letters or thereabouts; subsequently, 
he might embark upon the use of keying procedures which would have the effect of producing keys of 
a length approximately equal to that of the average message being enciphered; and finally, he might 
advance to a stage of keying sophistication wherein the key consists of hundreds or thousands of elements, 
or even of an infinite number of elements (as, for example, in autokey systems). 


1 Before the echoes of the first sentence of this third volume have died down, the distinction between the science of 
cryptanalytics and the art of cryptanalysis should be re-emphasized. The cryptanalyst pursues studies along general and 
detailed lines, in order to equip himself technically for the duties of the moment or of the future. This parallels quite closely 
the technical studies of a violinist, who progresses from elementary exercises to the études of Kreutzer and Rode and 
finally to the Caprices of Paganini; in the meanwhile, the violinist has also studied various solo works and chamber music 
as a means of enhancing his comprehension and appreciation of music in general. All that a technical background does for 
the violinist is to give him the means of artistic expression or synthesis of musical thoughts from the coding of clefs, keys, 
and notes; all that a technical background does for the cryptanalyst is to give him the means for imaginative expression 
or synthesis of plaintext meanings from the coding of systems, keys, and characters. See also in this connection footnote 5 


on p. 3 of Military Cryptanalytics, Part I. 
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e. At this point in our discussion it would be well to examine two terms defined in the previous 
volume: 
(1) periodic system. A system in which the enciphering process is repetitive in character and 
which usually results in the production of cyclic phenomena in the cryptographic text. 
(2) aperiodic system. A system in which the method of keying does not bring about cyclical 
phenomena in the cryptographic text. 


The foregoing are practical definitions—nobody in his right mind (and that of course includes all of our 
readers) ? would classify a Hagelin C-38 system? as periodic just because it really 7s periodic with a 
finite cycle of 26x25x23x21x19x17 or 101,405,850; nor would the same right-minded individual quibble 
with the classification of a system as aperiodic if the length of the key is only 1000 letters and messages 
very rarely exceed that length. In brief, what we are in effect saying is that, even if a system embraces 
in its principle a fixed cycle or period, unless the period is considerably shorter than the messages being 
enciphered (thus permitting the manifestation of cyclic phenomena), the system may nevertheless for 
all practical purposes be considered as aperiodic since the solution of a message is not predicated on writing 
the cipher text on several superimposed cycles and then solving the cryptographic depth thus produced. 

f. In this text we shall first examine varieties of aperiodic (as just defined) polyalphabetic sub- 
stitution systems; then we shall study methods of extending or lengthening short mnemonic keys, 
followed by systems using lengthy keys (to include digital and teleprinter systems). Subsequently, we 
shall study methods of solution of some typical cryptomechanisms and cipher machines, and aperiodic 
combination systems. The text proper will end with a discussion of principles of key analysis as applied 
in manual and machine cryptosystems, followed by an extensive treatment of cryptodiagnosis. The 
appendices include useful cryptologic and cryptomathematical reference material, concluding with a 
course of problems designed to insure comprehension of the principles expounded in this volume. 

2. General remarks on cryptographic periodicity—a. When we consider the nature of periodicity 
in polyalphabetic substitution systems, we note that it is composed of two fundamental factors, because 
there are in reality two elements involved in its production. We have appreciated the fact that periodicity 
necessitates the use of a keying element employed in a cyclic manner; now we begin to realize that there 
is also another element involved, viz., that unless the key is applied to constant-length plaintext group- 
ings, no periodicity will be manifested externally in the cipher text, despite the repetitive or cyclic use 
of a constant-length key. This realization is quickly followed by the idea that possibly all periodicity 
may be avoided or suppressed by either or both of two ways: (1) by using constant-length keying units 
to encipher variable-length plaintext groupings, or (2) by using variable-length keying units to encipher 
constant-length plaintext groupings. 

b. In the usual types of polyalphabetic substitution systems, successive letters of the repeating key 
are applied to successive letters of the text. With respect to the employment of the key, the crypto- 
graphic process may be said to be constant or fired in character. This is true even if a single keying unit 
serves to encipher two or more letters at a time, provided only the groupings of plaintext letters are 
constant in length. In all such cases of encipherment by constant-length groupings, the apparent length 
of the period (as found by applying the factoring process to the cryptograms) is a multiple of the real 
length and the multiple corresponds to the length of the groupings, i.e., the number of plaintext letters 
enciphered by the same key letter. It is to be noted, however, that all these cases are still periodic, 
because both the keying units and the plaintext groupings are constant in length. 

3. Effects of varying the length of plaintext groupings.—a. Now let us consider the effects of making 
either one or the other of these two elements variable in length. Suppose that the plaintext groups are 
made variable in length and that the keving units are kept constant in length. Then, even though the 
key may be cyclic and may repeat itself many times in the course of encipherment, external periodicity 
is suppressed, wnless the law governing the variation in plaintext groupings is itself cyclic, and the length of 
the message is greater than that of the cycle applicable to this variable grouping. 


2? To scholars of English who experience a quick intake of breath at this point, the author hastens to clarify that the 
parenthetical phraxe is intended te modify only the four immediately preceding words. 
3 Cf. pp. 458-464 of Military Cryptanalytics, Part I. 
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b. As an example illustrating the italicized portion of the preceding sentence, let us suppose the 
correspondents agree to use reversed standard cipher alphabets with the key word SIGNAL, and that 
in the encryption the message is divided into groups as shown below: 


SI G N A Ls I G N 
1 12 123 1234 12345 12 123 1234 12345 
C OM MAN DING GENER LF IRS TARM YHASI 
Q UW _UGT KFAH UWNWJ HN ARQ NGPU PGNVF 


A Ls I N A OL s 
12 123 1234 12345 12 123 1234 12345 
Tl VET WENT YFIRS AT NOO NDIR ECTIN 
HS QHS WOFZ KDARQ_N NU NMM YIDU OQZKF 


G N A 5 i 

12 123 1234 123545 1 12 123 

OM MAS WITC HBOAR D SC OMM... 
UW_UGO RFUL TZMAJ I AQ UWW 


L S I G 

12 123 1234 12345 
SU EDO RDER SEFFE 
TR OPE RFER OCBBC 


12 123 1234 12345 
TH ATT ELEP HONES 
NZ NUU WPWL EXYHT 


riawerer en Per 
QANQKRPH HUME YS 


warn rary 
H 


Cryptogram 


QUWUG TKFAH UWNWJ LHNAR QNGPU PGNVF ITROP ERFER OCBBC LHSQH 
SWOFZ KDARQ NNUNM MYIDU OQZKF CNZNU UWPWL EXYHT QUWUG ORFUL 
TZMAJ IAQUW W... 


The cipher text in this example shows a tetragraphic and a pentagraphic repetition. The two occurrences 
of QUWUG, (=COMMA, ) are separated by an interval of 90 letters; the two occurrences of ARQN, (=IRST,) 
by 39 letters. The first repetition (QUWUG,), it will be noted, is a true periodic repetition, since the 
plaintext letters, their groupings, and the key letters are identical. The interval in this case, if counted 
in terms of letters, is the product of the keying cycle, 6, and the grouping cycle, 15. The second repetition 
(ARQN,) is not a true periodic repetition in the sense that both cycles have been completed at the same 
point, as is the case in the first repetition. It is true that ARQN,, representing IRST, both times, is a 
causal repetition produced by the action of the same combination of key letters, I and G, but the en- 
ciphering points in the grouping cvcle are different in the two occurrences. Repetitions of this type may 
be termed partially periodic repetitions, to distinguish them from those of the completely periodic type. 

c. When the intervals between the two repetitions noted above are more carefully studied, especially 
from the point of view of the interacting cycles which brought them about, it will be seen that, counting 
according to groupings and not according to single letters, the two pentagraphs QUWUG, are separated 
by an interval of 30 groupings. Or, if one prefers to look at the matter in the light of the keying cycle, 
the two occurrences of QUWUG, are separated by 30 key letters. Since the key is but 6 letters long, it 
has gone through 5 cycles. Thus, the number 30 is the product of the number of letters in the keying 
cycle (6) and the number of different-length groupings in the grouping cycle (5). The interaction of 
these two cycles is like that of two gears in mesh, one driven by the other. One of these gears has 6 teeth, 
the other 5, and the teeth are numbered. If the two gears are adjusted so that the teeth marked ‘‘1”’ 
are adjacent to each other and the gears are caused to revolve, these two teeth will not come together 
again until the larger gear has made 5 revolutions and the smaller one 6. During this time, a total of 30 
meshings of individual teeth will have occurred. But since one revolution of the smaller gear (=the 
grouping cycle) represents the encipherment of 15 letters (when translated in terms of letters), the 6 
complete revolutions of this gear mean the encipherment of 90 letters. This accounts for the period of 
90, when stated in terms of letters. 

d. The two occurrences of the other repetition, ARQN,, are at an interval of 39 letters; but in terms 
of the number of intervening groupings, the interval is 12, which is obviously two times the length of 
the keying cycle. In other words, the key has in this case passed through two cycles. 

e. In a long message enciphered according to such a scheme as the foregoing, there would be many 
repetitions of both types discussed above (the completely periodic and the partially periodic) so that 
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the cryptanalyst might encounter some difficulty in his attempts to reach a solution, especially if he 
had no information as to the basic system. It is to be noted in this connection that if any one of the 
groupings exceeds, say, 5 letters or so in length, the scheme may give itself away rather easily, since it 
is clear that within each grouping the encipherment is strictly monoalphabetic. Therefore, in the event of 
groupings of more than 5 or 6 letters, the monoalphabetic equivalents of telltale words such as ATTACK, 
BATTALION, DIVISION, would stand out. This system is most efficacious, therefore, with short groupings. 

f. It should also be noted that there is nothing about the scheme which requires a regularity in the 
grouping cycle such as that embodied in the example. A lengthy grouping cycle guided by a key of its 
own may just as easily be employed; for example, the number of dots and dashes contained in the Inter- 
national Morse signals * for the letters composing the 25-letter key phrase DECLARATION OF INDE-— 
PENDENCE might be used. Thus, A (. —) has 2, B (_...) has 4, and so on. Hence: 


DECLARATIONOFINDEPENDENCE 

B144232128323422383i14128i1241 
The grouping cycle is 3+1+4+4+2+ ... , or 60 letters in length, and if the same phrase is used as 
a repeating key the total period would of course be 60, since after the encipherment of 60 letters the 
first key letter would be used again to encipher 3 letters, and so on, repeating the cycle. Suppose, however, 
that the foregoing 60-element keying pattern were used in conjunction with a different literal sequence 
for the actual key letters, say the 38-letter phrase CONSTITUTION OF THE UNITED STATES OF AMERICA. 
The period would then be the least common multiple of 38 and 60, or 1140 letters. This system might 
appear at first glance to yield a fairly high degree of cryptographic security; but this is not the case, as 
we shall presently see. 

4. Primary and secondary periods; resultant periods.—a. It has been noted that the length of the 
complete period in a system such as the foregoing is the least common multiple of the length of the two 
component or interacting periods. In a way, therefore, since the component periods constitute the basic 
elements of the scheme, they may be designated as the basic or primary periods. These are also hidden 
or latent periods. The apparent or patent period, that is, the complete period, may be designated as the 
resultant or secondary period. In certain types of cipher machines there may be more than two primary 
periods which interact to produce a resultant period; also, there are cases in which the latter may interact 
with another primary period to produce a tertiary period, and so on.® The final, or resultant, or apparent 
period is sometimes the one which is usually ascertained first as a result of the study of the intervals 
between repetitions. This may or may not be broken down into its component primary periods. 

b. Although a solution may often be obtained without breaking down a resultant period into its 
component primary periods, the reading of many messages pertaining to a widespread system of secret 
communication is much facilitated when the analysis is pushed to its lowest level, that is, to the point 
where the final cryptographic scheme has been reduced to its simplest terms. This may involve the 
discovery of a multiplicity of simple elements which interact in successive cryptographic strata. 

5. Cryptographic principles of aperiodic systems.—a. A discussion of the methods for avoiding 
periodicity was contained in the preceding text.® A brief résumé of these methods is given below: 


(1) Elements of a fixed or invariable-length key are applied to variable or irregular-length groupings 
of the plain text. 

(2) Elements of irregular-length (variable-length) key are applied to regular and fixed groupings 
of the plain text. 

(3) The principles of (1) and (2) are combined into a single system. 


4 Cf. p. 28, Military Cryptanalytics, Part I. 

5 An example of a cipher machine with several interacting latent periods is the Hagelin C-38. This machine produces 
in effect at any given moment six simultaneous reversed-standard-alphabet monoalphabetic substitutions in all 26 com- 
binations of their presence or absence. The activity of each contributing monoalphabetic substitution is strictly periodic, 
with cycles of 26, 25, 23, 21, 19, or 17, conforming to the six regularly stepping pinwheels of the stated sizes. The total 
cycle of the machine is the product of the six relatively prime numbers, but the presence of individual subcycles constitutes 
one of the serious weaknesses of the machine. 

6 Cf. par. 99, Military Cryptanalytics, Part II. 
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(4) The key does not repeat itself; this is brought about either by constructing a nonrepeating key, 
or by employing the key in a special manner (such as in plaintext- and ciphertext interruptor systems 


and plaintext- and ciphertext autokey systems). 
b. From the standpoint of cryptographic mechanics, aperiodic systems may be divided into two 


main classes, viz.: 
(1) Systems in which the key elements are not in any way determined or influenced by any elements 


of the plain or cipher text; and 
(2) Systems in which the key elements are generated or governed by the plain text being enciphered 


or by the resultant cipher text. 


-18 USC 798 
-50 USC 3024 (i) 
86-36 
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SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 
VARIABLE-LENGTH PLAINTEXT GROUPINGS 
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7. General remarks.—a. The system described in subpar. 3b is obviously not to be classified as 
aperiodic in nature, despite the incorporation into the cryptosystem of a variable which in that case 
consisted of irregularity in the length of one of the two elements (key text and plain text) involved in 
polyalphabetic substitution. The variable there was subject to a law which in itself was periodic in 
character. 

b. To make such a system truly aperiodic (under the definition given in subpar. le), by elaborating 
upon the basic scheme for producing variable-length plaintext groupings, would be possible, but im- 
practical. For example, using the Morse code method illustrated in subpar. 3f for determining the key 
and simultaneously the lengths of the groupings, one might employ the text of a book; and if the book 
is longer than the message to be enciphered, the cryptogram would certainly show no periodicity as 
regards the intervals between any repetitions which might occur. However, as already indicated, such 
a scheme would not be very practical for regular intercommunication between a large number of corre- 
spondents, for reasons which are quite apparent. Encipherment and decipherment would be slow, 
cumbersome, onerous, and very subject to error; the book would have to be safeguarded as would a 
code book; and, unless the same key text were used for all messages, methods or indicators would have 
to be adopted to show exactly where encipherment begins in each message. Therefore a simpler method 
is desirable for producing constantly changing, aperiodic plaintext groupings. 

8. Aperiodic encipherment produced by plaintext sequences grouped according to word lengths.— 
a. The simplest method for producing aperiodic plaintext groupings is encipherment according to the 
actual word lengths of the message being encrypted. Although the average number of letters composing 
the words of any alphabetical language is fairly constant, successive words comprising plain text vary a 
great deal in this respect, and this variation is subject to no law.’ In telegraphic English, for example, 
the mean length of words is 5.2 letters; the words may contain from 1 to 15 or more letters, but the 
successive words vary in length in an extremely irregular manner, no matter how long the text may be. 

b. As a consequence, the use of word lengths for determining the number of letters to be enciphered 
by each key letter of a repetitive key suggests itself to a cryptographer as soon as he comes to understand 
the way in which repeating-key ciphers are solved. For, he asks, if there is no periodicity in the crypto- 
grams, how can the letters of the cipher text written in 5-letter groups be distributed into their respective 
monoalphabets? And if this very first step is impossible, how can the cryptograms be solved? We shall see. 

9. Solution when known cipher alphabets are involved.—a. Despite the foregoing rhetorical ques- 
tions, the solution is really quite simple when the cipher alphabets involved are standard alphabets or 
are otherwise composed of known sequences. All that is involved is the completion of the plain-component 
sequence (preceded by,.if the situation so demands, conversion into plain-component equivalents). In 
monoalphabetic substitution systems, all of the words of the entire message come out on a single gen- 


1It is true, of course, that the differences between the vocabularies of two writers are often marked and can be 
measured. These differences may be subject to certain laws, but these laws are psychological rather than mathematical. 
See Rickert, E., New Methods for the Study of Literature, University of Chicago Press, Chicago, 1927. 
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eratrix in the completion diagram; in the case of the system discussed in subpar. 86, since the individual, 

separate words of a message are enciphered by different key letters, these words unll reappear on different 

generatrices of the diagram. All the cryptanalyst has to do is to pick them out; he can do this once he has 

found a good starting point, by using a little imagination and following clues afforded by the context. 
b. As an example, let us consider the following intercepted message: 


SUHPZ TCEPL GLQKC XHVKM VJILZA KXWHA 
YTOWN HBAFE XAVEQ AUVZI EBPOB 
In the course of routine study of the message, the plain-component sequence is completed for the first 


15 letters of the cryptogram, on the assumptions of direct and reversed standard cipher alphabets, as 
shown in Figs. 2a and 8, respectively, below: ? 


HW 


G 


& 
A 
wn 
lao} 
le] 
as) 
[oad 
a2 
C2 


QODVATAWDEFPNK XM SAS CHVNDHO'VIN 
OPO ZEBUARGHINQDAAOTCAQWPEPNK HM 





uO 
qrH 
vo 


o25r 
qHnADW 


GH Tt 
PNK MSS CHNDAHOH VIO Z2Saer 


Den x SG 
OZEB UTR GH SE 
Bx CHwnwno'v 
AoHIOQDAVAWPEN 
AUQWPrPNK HME CH 


HunNwWovdso2ar 


MUQWFNK MS 


| 


GHOIOQDAAUDUQWPNK KH SS CH NWAOVSU ZaSORK 


Z2E 0 RGH LOY 


VOSZBUMARGH TOY 
PNM SS CHAWO'N 


OZ2BOTNRAGH IO DACA PIN 


—S—e Bs CHnAWO VOI ABRO AI 
YPAVOAWDPFPNK KM SKICHANDWOVAOSAEOIARAGH IQ 





ANA OVAOSZESEOTIRUHTAAATIA 


PNK MSN CHNWOVSIUAZBOKG 


SrAGH OQNMVCQWPNK HM Sc cHN 


QWPFPNK KH SM CHANWO VIO ABRZMRAGHE 
PNK MH SKI CHNWOHVOABRMAGHIA A! 
ZERUORGCHINQDMATQWPNK HBA CHYN 


GYGHOOQAMITAWEN 
Nx ws SCH NDWHO'N 





DrePnNK XM SSCHNAOVAIAZEREMARGHTOQYAHROA 
AGHrQHAVGAW YPN «KK 


] 


NAOVOABSMWrRAUn LAY 
WAG 


AOVO® 
WHnNADO 'V 
DGTQWPFPNnK x SSC 
O2ZEBTRGHAAS 
vo 
GHIOUQDQDAMVAD 
DWreNnNt x Ss cyH 


Sx CHNWDAOVSIA]ABROTARGHTMO AMO AWPEN 6K IQ 


QAO 

moaQwW 

AN'VOS 
GHADO VO ZEMrAYHIODSG 
nnAoOoVWUSmABEIAKAG 
220A UH LO 

HUQ AMoVAQW 

OZER GH SE 

Ba CHANnNDWHO'V 


Ficure 2a Fiaure 2b 


c. In the diagram in Fig. 2b we note the word CAN at the beginning of one generatrix, then in the 
very next six columns the words YOU and GET in two other generatrices. That we should get some three- 
letter words on various generatrices is not particularly remarkable; (note the short words produced 
purely by accident in the generatrices of Fig. 2a) but that these words should follow one another in 
direct sequence in succeeding columns, and that the three words in question should be in excellent 
contextual relationship to form a plausible and convincing sentence beginning such as “CAN YOUGET. . .” 


2 One of the first things, if not the very first, to be done to a cryptogram in an undiagnosed system is the completion 
of the plain-component sequence on the basis of standard alphabets. In certain cases a solution is sometimes achieved by 
this means that would be impossible by any other. The completion is painless if accomplished by sliding strips; its proba- 
bility of success in an isolated case is small, but the ratio of the time expended to its potential value is very large. This 
is a typical illustration of the application of the maxim of the experienced cryptanalyst: ‘Try the stmplest thing first.” 


Sith 8 





—SEGRET 


- is more than remarkable (=a probability of .01 of random occurrence)—it is astonishing (=random 
probability of .0001) 3 

d. From here on the rest of the solution follows easily. If the cryptanalyst comes to a temporary 
halt (as in the example in Fig. 2b) in recovering further words on the generatrices, he can search in 
subsequent positions of the generatrix diagram for more words to be disclosed, and then he can fill in 
the missing portions from context and take another look at the generatrices. Or, it might be simpler if 
the cryptanalyst recovers a fragment of the specific key for the message, and then expands this key by 
steps to assist in reading the rest of the plain text. For example, in the case under discussion the crypt- 
analyst would get U, N, and I as key letters * for the successive words of the plain text CAN YOU GET; 
these letters suggest the words UNION, UNITED, UNIVERSITY, etc. The complete solution is given below, 
with the recovered specific key being UNITED NATIONS.° 


U N idI iT E D N A T I Oo N S 
CAN YOU GET IN TOUCH WITH SECOND DETACHMENT STOP LINES OUT OF ORDER 
SUH PZT CEP LG LQKCX HVKW VJLZAK XWHAYTOWNH BAFE XAVEQ AUV ZI EBPOB 


The only minor difficulty of such a solution is that of making the first step and getting a good start on 
a word. If the words are short it is rather easy to overlook good possibilities and thus spend some time 
in fruitless searching. However, solution must come; if nothing good appears at the beginning of the 
message, search should be made in the interior of the cryptogram or at the end. 

10. Solution when unknown cipher alphabets are involved.—a. It has been seen from the foregoing 
that solution of cryptograms involving word-length encipherment by standard alphabets is rather 
trivial, not because there is any magical quality about standard alphabets, but because the components 
are known sequences. If any other components had been used, say a plain component based upon a 
HYDRAULIC keyword-mixed sequence and a cipher component based on a QUESTIONABLY keyword- 
mixed sequence, and if these components were known, the problem would have been pursued in exactly 
the same way, viz., conversion of the cipher letters of the cryptogram into their plain-component 
(HYDRAULIC . . . XZ) equivalents and completion of the plain-component (HYDRAULIC .. . XZ) 
sequence. 


6. But what if one or both of the components are unknown mixed sequences? The simple procedure 
of completing the plain-component sequence obviously cannot be used. Since the messages are poly- 
alphabetic, and since the process of factoring cannot be applied, it would seem that the solution of 
messages enciphered in different alphabets and according to word lengths would be a difficult matter. 
Nevertheless, as is about to be demonstrated, the solution, even of a single message, is not nearly so 
difficult as first impression might lead one to imagine; the modus operandi will be explained in pars. 
11 and 12. 

11. Solution by means of idiomorphs and the probable-word method.— a. The first case to be studied 
involving unknown alphabets will be one wherein the original word lengths are retained in the crypto- 
gram; this case will be discussed not because it is often encountered in practical military cryptography, 
but because it affords a good introduction to the usual case in which the original word lengths are no 
longer in evidence in the cryptogram, the latter appearing in the customary 5-letter groups. If the words 


3 We must never forget that probabilities are influenced by the amount of material under examination; if we looked 
at enough material, it might not be at all astonishing if we obtained even a 10-letter word by accident. In all the proba- 
bility considerations in this text, unless otherwise stated it is assumed that we are dealing with a limited amount of traffic, 
limited enough so that a probability of .01 is remarkable, and a probability of .001 exciting. 

4The key letters are assumed to be under A, as the index letter. Throughout this text, whenever encipherment 
processes are under discussion, the pair of enciphering equations commonly referred to as characterizing the so-called 
Vigenére method will be understood unless otherwise indicated. This method involves the pair of enciphering equations 
0. 27= 8:1; Opn =Ger. That is, the index letter, which is usually the initial letter of the plain component, is set opposite the 
key letter in the cipher component; the plaintext letter to be enciphered is sought in the plain component and its equivalent 
is the letter opposite it in the cipher component. See in this connection subpar. 13f of Military Cryptanalytics Part II. 

5 This is the specific key as recovered from this single message. It is quite possible that the complete key is UNITED 
NATIONS ORGANIZATION, UNITED NATIONS SECURITY COUNCIL, etc.; a longer message would prove whether the key is 
UNITED NATIONS used repetitively, or whether it is a phrase beginning with these two words. 
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of a message are enciphered monoalphabetically, the true and complete idiomorphs of word patterns 
will be patent, regardless of the identity of the particular alphabet used in the encryption of each word. 
These idiomorphs and word lengths can then be used as a basis for the probable-word method of attack. 


b. Let us study the following low-echelon ground message in which the actual word lengths have 
been preserved in the cipher text:°® 


IVUITD QHIWE LVCGWPCLZ RP NIV GYPYSYCV NC IXHCXWUJ ORS ZXH 
GRPPRVQDOB SE OKYNMMHKV GUJLTN MYIN WZ IVURNI CLSWZVHS 
We note some strong idiomorphic sequences, in particular the following: 


(1) IUITD (2) GYPYSYCV (3) GRPPRVQDOB (4) OKYNMMHKV 
aba abaca abba abceddea 


Looking up these patterns in idiomorph lists,’ and guided by the delimitations of the words, we arrive 
at the following assumptions: 


(1) IUITD (2) GYPYSYCV (3) GRPPRVQDOB (4) OKYNMMHKV 
ENEMY. DIVISION BATTALIONS ARTILLERY 


The cipher values of these plain-cipher equivalencies are entered into a sequence reconstruction matrix 
of four levels (representing the four word assumptions), as follows: 


P:ABCDEFGHIJKLMNOPQRSTUVWXYZ 








(1) I TU D 

(2) G Y ve S P 

(3) |R G Q Vv 0D B P 

(4)|0 H N M K Y V 
FicureE 3a 


Noting in lines (2) and (3) that the intervals between the letters G, V, and P are the same in both cases, 


we can assume direct symmetry ® of position. In a few moments our reconstruction matrix will look 
like this: 








P: ABCDEFGHIJKLMNOPQRSTUVWXY2Z 

(VISHBPIN M RGTUK 7 Q VcoonD 

(2)IM RGTUK YQ VvcOD SHBPIN 

(3);|RGTUK Y Q vcooD SHBPIN M 

(4)|0 D SHBPIN M RGTUK Y Q Vc 
Figure 3b 


c. The rest of the plain text can be recovered either by (1) completion of the plain-component 
sequence, insofar as possible, in order to reveal further plaintext fragments which may be expanded and 
thus make possible the filling in of additional values in the cipher component, or by (2) recovery and 
expansion of the partial specific key for the message. An important additional step in solution is the 
recovery of the missing letters in the cipher component by analysis of the construction of the component 
in cases of systematic derivation. These points will be taken up in order in the subparagraphs below. 


6 Foolish as this may be, it has happened in operational practice. 
7 Cf. Appendix 3, Military Cryptanalytics, Part I. 
8 Cf. par. 28, Military Cryptanalytics, Part IT. 
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(1) Let us complete the plain-component sequence on the second and third words of the message, 
after first converting the cipher letters into their plain-component equivalents (where known), using for 
this purpose the uppermost cipher alphabet given in Fig. 3b. This is shown in the illustration below: 











IUITD QHIWE ee LVCGWPCLZ LVCGWPCLZ 

ENEMY SBE VWL D GVWL DW HVWL DW 
TCF WXM a HWXM EX IWXM EX 
UDG XYN FY IXYN FY JXYN FY 
VEH YZO GZ JYZO GZ KYZO GZ 
WFI ZAP HA KZAP HA LZAP HA 
XGJ ABQ IB LABQ IB MABQ IB 
YHK BCR JC MBCR JC NBCR JC 
ZIL CDS KD NCDS KD OCDS KD 
AJM *DET LE ODET LE PDET LE 
BKN EFU MF PEFU MF QEFU MF 
*CLO FGV NG QFGV NG RFGV NG 
DMP GHW OH RGHW OH SGHW OH 
ENQ HIX PI SHIX PI THIX PI 
*FOR IJY QJ TIJY QJ ULJY QJ 
GPS JKZ RK UJKZ RK VJKZ RK 
HQT KLA SL VKLA SL WKLA SL 
IRU LMB TM WLMB TM XLMB TM 
JSV MNC UN XMNC UN YMNC UN 
KTW NOD VO YNOD VO ZNOD VO 
LUX OPE WP ZOPE WP AOPE WP 
MVY PQF XQ APQF XQ BPQF XQ 
NWZ QRG YR BQRG YR CQRG YR 
OXA RSH ZS CRSH ZS DRSH ZS 
PYB *STI AT DSTI AT *ESTI AT 
QZC TUJ BU ETUJ BU FTUJ BU 
*RAD UVK CV FUVK CV GUVK CV 
FicureE 4a Figure 4b Figure 4c 


The generatrices with the most plausible possibilities for the continuation of plain text are marked with 
an asterisk. If the context of the message cannot be gotten from this diagram, what we can do is to take 
the third word, LVCGWPCLZ, and assume that the letters for which we have no plain-component equiva- 
lents in the first cipher alphabet of Fig. 3b represent one of the eight missing plaintext letters, G, H, J, 
P, R, T, U, or Z. If we assume that the first letter (L,) of this word represents G, (on the first or conversion 
row of the generatrix diagram just beneath the ciphertext letters), we obtain the result shown in Fig. 46; 
when we try L,=H,, as shown in Fig. 4c, we obtain an excellent plaintext tetragraph on the third genera- 
trix from the bottom, and see that the word is ESTIMATED. The newly recovered values in the cipher 
alphabet will aid in establishing the remaining unknown letters in the generatrix diagrams for other 
words of the message. 

(2) For the second method, let us refer again to Fig. 4a. The key letter used to encipher the first 
word, ENEMY, is S, (assuming A, to be the index letter in the usual Vigenére equation), since I.=Ep. 
Now for the second word, if Qg=C, (one of the asterisked good generatrices for this word), the key is 
Yu; if Q.=Fp, %& =U; and if Q.=R,, 6.=H. The first key digraphs thus formed, SY, SU, and SH, are all 
compatible as English word beginnings. For the third word of the message, considering the two asterisked 
generatrices in Fig. 4a, if V.=D,, 6.=Q; if V.=S,, =P. Therefore the first three key letters are now 
resolved as SYP or SUP; SYP is quickly discarded, and SUP should be followed by an E, I (less likely), 
P, or R, suggesting words such as SUPERIOR, SUPPORT, or SUPREME. A quick check on the message 
establishes that, with #.=R, the fourth word deciphers to AT,. Proceeding in this fashion, we are able 
to recover the key and simultaneously the plain text in record time. 
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(3) In cases wherein the cipher component has been constructed in some systematic manner, analysis 
of its derivation will make possible recovery of the component in its entirety after a sufficient number of 
values has already been placed correctly.° What constitutes ‘‘a sufficient number of values’? depends 
upon the type of construction of the component, as well as the vagaries of the particular situation at 
hand. Taking for example the cipher component as established in Fig. 36, 


SHBPIN..M.RGTUK.Y.Q..VCOD., 


we observe the digraphic fragments BP and GT. If these are a part of a transposition-mixed sequence, 
the mechanics of the system would indicate that the fragments are part of the diagram B. . . G, 
PQRST 
which means that three of the letters CDEF lie in order between B and G, and that directly above them 
are the letters composing the key word for the transposition matrix. However, since R immediately 
precedes the G in the sequence, it appears that R is part of the key word and not part of the remaining 
HYDR 
alphabetic portion. Thus the fragmentary matrix B . . Gcan be reconstructed, from which, with but 
PQST 
little imagination, the key word HYDRAULIC may be seen emerging, so that the entire component is 
derivable from the following diagram: 


vO mos 
Omn< o 
n'AOW 
HaQAnWN 
<4 PH 
=RxcCo 
x=SBOr Oo 
NAHWO 

Oa2Nn 


d. By means of the foregoing methods, we can establish that the primary components are the 


following: 
P: ABCDEFGHIJKLMNOPQRSTUVWXKYZ 
Cc: AJVCODFSHBPINZLMXRGTUKWYEQ 
The complete message and the specific key are given below: 
s U P R E M E Cc Oo = uUU 


ENEMY FORCE ESTIMATED AT ONE DIVISION OF INFANTRY AND TWO 
IUITD QHIWE LVCGWPCLZ RP NIV GYPYSYCV NC IXHCXWUJ ORS ZXH 


R T 0 F T 4H E U (NITED STATES) 
BATTALIONS OF ARTILLERY MOVING WEST OF NEWTON JUNCTION 
GRPPRVQDOB SE OKYNMMHKV GUJLTN MYIN WZ IVURNI CLSWZVHS 


Now that the components have become known sequences, the solution of subsequent messages en- 
ciphered with these components but with different specific keys is a simple matter, involving only a 
conversion of the cipher letters into their plain-component equivalents and a completion of the plain- 
component sequence. This point required re-emphasizing because in actual operational problems it is 
frequently forgotten. 

e. The example in subpar. b involved a case of direct symmetry of position. If both the plain and 
the cipher components had involved mixed sequences, indirect symmetry of position would have 


® For a treatment of the cryptographic mechanics of systematically mixed sequences and their cryptanalytic recovery, 
see par. 51 (on pp. 86-90) of Military Cryptanalytics, Part I. 
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applied.!° As an example of such a case, let us suppose that the cipher text of the message in question 
had been different, and that the sequence reconstruction matrix in Fig. 3¢ had been the following: 


PABCDEFGHIJKLMNOPQRSTUVWXY2Z 








1 H UL 0 

2 J P YD U I 

3/R C L U MN Qs 

4|0 W S Q N C K 
FIGure 5 


(1) We observe the proportion AR (@-1, 3-1) =ON (#15, 3-15) which is duplicated in AR (#-1, 
§-18)=ON (4-1, 4-18);'! this is indicative that symmetry extends to the @ line, and therefore that the 
plain and cipher components are identical sequences. Consequently, we are able to chain to the 9 line, 
deriving the following sets of partial chains: 


g-1 EH MU NL Y 0 

$2 ODJ VIP NY SU 

g-3 AR BC ILU ONM TS Q 

g-4 AO EW Is L Q RN TC YK 
FIGURE 6 


(2) We note that the fragmentary chains ONM and TSQ of the 0-3 set appear to be parts of a keyword- 
mixed sequence in reverse; so, proceeding with the graphical method * of indirect symmetry, we assign 
to these chains the notation —, and then we arbitrarily assign the notation | to the #2 chains. The 
four sets of fragmentary chains will then be amalgamated into the diagram shown in Fig. 7a, below. 


CB 1 2 38 4 5 6 7 8 9 10 IL 19 13 14 15 16 17 18 19 20 21 22 2B 24 25 26 
QsTV JKMNOPQSTYV x vs : 
ULI YDRAULICB 
K MN OP JKMNOPQSTYV 
YDRA 
J 
Figure 7a Fieure 7b 


This diagram may then be expanded into that shown in Fig. 7b, consisting of the integration of two 
major chains tied together by the vertical VIP relationship. 

(3) Now noting in Fig. 7b the sequence VCS on a diagonal and the letters S.V in the top row, we 
realize that the distance V to C when measured on the primary component should be 12, i.e., one-half 
of the distance (24) between V and S on the top row. Consequently, we may place the C at a position 
12 spaces to the right of the V, which permits us to expand our diagram into the following: 


1 2 3 
J KM 





Ficure 7c 


(4) The fragmentary chains EH and EW in Fig. 6 could have been placed in their proper positions 
earlier in Figs. 7a-c; however, in order to illustrate a point, we have delayed their amalgamation until 
now. We note that the 8-1 chains in Fig. 6 are at a decimation of —10 in the sequence in Fig. 7c; there 
is only one possible placement of the letters E and H at this interval, which then fixes the position of the 


10 Cf. Chapter VI, Military Cryptanalytics, Part II. 
This notation has been discussed in footnote 2 on p. 92, Military Cryptanalytics, Part II. 


2 Cf, par. 46, Military Cryptanalytics, Part IT. 
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last unused letter, W, the placement of which heretofore could have been ambiguous. These letters fit 
into the reconstructed sequence as follows: 


JKMNOPQSTVW..HYDRAULICBE 


It is a pleasure to use, without encountering a risk of cavilation the word “obvious” ™ as regards the 
positions of the missing letters: 


JKMNOPQSTVWXZHYDRAULICBEFG 


Jf. The immediately preceding example treated a case of identical sequences proceeding in the same 
direction for the plain and cipher components. If the cipher component had run in the reverse direction, 
or if the components had been two different [unknown] mixed sequences, indirect symmetry would still 
have applied, with the exception (and a very important exception indeed) that chains to the § line 
would have been excluded, all chaining being done within the matrix. This prohibition would result in 
the situation that not only would a single short message encrypted in such a system be well-nigh unsolv- 
able, but that even if we had a long message or a small volume of traffic, it would probably be necessary 
to make a fairly large number of assumptions, all correct, before there would be enough data available 
to permit their manipulation and exploitation by indirect symmetry. 

g. Now that we have understood the details of solution of cases wherein the true word lengths have 
been preserved, we will take up the situation wherein the cipher text has been transmitted in its usual 
form of 5-letter groups. 

(1) Let us suppose that we have a number of messages, all of which are known to have been en- 
ciphered monoalphabetically by word lengths with the same pair of unknown primary mixed components 
and (although this is not a vital consideration) in the same message key.“ Five messages have been 
selected from the aggregate because of the presence of polygraphic repetitions between them; the begin- 
nings of these messages are shown in Fig. 8a, below: 


1L.GKBSA MKUHQ PJCGK KLJHK CFVTY 


2ALEIQ AKGLY LWHRH CDHKU VBVPV 


R 
3 STTIU MAMKU ZIUVS VNRLZ OKLZP 
J 


4LKQAM GIJEU MGPJC GKKLJ HBEKYV 


5. BK JUA IESAA SBRHS LYLWH HQYEP 


Ficuren 8a 


13 The reader is reminded of the pithy anecdote on the word “‘obvious’’ quoted in footnote 11 on p. 6 of Military 
Cryptanalytics, Part I, 

4 Tf this latter fact had not been known, it could have been conjectured, from an examination of the I.C.’s of groups 
of columns, that the same message key was used for all the messages. In the particular example in Fig. 8a, the I.C. of 
the first 5 columns (taken collectively) is 1.56, while that of the first 10 is 1.76, and thereafter the I.C. drops off very 
rapidly even though we are adding more data to our distribution for evaluation. The grouped I.C.’s for the first N columns 
are summarized in the diagram below: 





| N Le. N Le. 
hae i BRS 12 | 1.3 
6 | 1.55 15 | 1.33 
Sor ATS 20 | 1.37 
io | 1.76 25 | 1.24 


The reason for the low I.C.’s of the first 5 and the first 6 columns is that the sample was insufficient to portray what we 
expect of English plain text; on the other hand, the reason for the high I.C.’s of the first 8 and the first 10 columns is 
that the beginning words of these messages probably exceed the average length (5.2 letters) of all English words. 
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(2) The 5-letter and 9-letter repetitions have the length and idiomorphic patterns of ENEMY and 
ARTILLERY, respectively. Taking into account that the average word length in telegraphic English 
plain text is 5.2 letters, it appears that both of these words were probably enciphered by the third letter 
of the message key,” although the relative numerical identity of the particular alphabet is really of no 
concern to us at the moment. On the basis of the idiomorphic beginning, Message No. 3 could start 
with the word AMMUNITION, making the 4-letter repetition TION which is cryptolinguistically titillating; 
the first word of Message No. 1, LOCATION, comes immediately thereafter, which is followed by 
COUNTERATTACK at the beginning of Message No. 5, HOSTILE at the beginning of Message No. 4, and 
THRUST at the beginning of Message No. 2. From the solution of the first three words of these five 
messages, and with the concurrent exploitation of the direct symmetry manifested, the primary cipher 
component is established as 


SHBPI.ZLM.RGTUKWYEQAJVC.ODF 


(3) The key letters (under A,) of the first three alphabets are S, U, and P. The rest of the solution 
proceeds either by the generatrix method as outlined in subpar. 11c(1), or by analysis of the key as 
illustrated in subpar. 11¢(2). The complete texts of the message beginnings are shown in Fig. 86, below: 





1 GKBSA MKUIHQ) PJ CGK KLJH|/K CFVRT. 
LOCAT ION|IOF| ARTIL LERYjE MPLAC 
2 ALEJQ AIKGILY LWHiIRH CDHKU;}| VBVPV. 
THRUS TIBYJEN EMYJAR MORED!]| ELEME 
3 STTIU MAMKU| ZIUVS| VNRLZ OKL@ZI/P. 
AMMUN ITION!| TRAIN) SCHED ULEDIT 
4, LKQAM GIjJJIEU MGiIPJC GKKLJ HiIBEKYV. 
HOSTI LEIHEA VYIART ILLER YISHEL 
5 BKJUA ITESAA SBRIHS| LYLWH)| HQYEZ|. 
COUNT ERATT ACKION| ENEMY] RIGHT 
Figure 8b 


(4) It may be seen from the foregoing example that the general theory of idiomorphic attack and 
the probable-word method remains the same for 5-letter texts as it is for text divided into bona fide word 
lengths; only the details of the execution differ. Where a small volume of homogeneous traffic is at hand, 
and something is known about the correspondents and the nature of the messages, solution should pose 
no problems (other than usual cryptanalytic headaches concomitant with operational situations of 
minor systems in which only a few messages are available). 

12. Solution by means of isomorphs.—a. The phenomenon of isomorphism and an illustration of 
the exploitation of isomorphs in cipher text were covered in the previous volume.” In practical crypt- 
analysis the phenomena of isomorphism afford a constantly astonishing source of clues and aids in 
solution. The alert cryptanalyst is always on the lookout for situations in which he can take advantage 
of these phenomena, for they are among the most interesting and most important in cryptanalytics. 


8 We have already noted that the common plain-cipher equivalencies Ep>=L, and Y,~H, in the two words establish 


the fact that these words were enciphered by the same alphabet. 
16 Cf. par. 71, Military Cryptanalylics, Part IT. 
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b. Let us consider the case of word-length encipherment involving an unknown pair of primary 
components, the cipher text being transmitted in the customary 5-letter groups. The following crypto- 
gram is available for study: 


BH IoD eb De 2a PR 2EOCk bie D FY Goo RD 
PFQXX QGYJP RXGJIG LTSRM KSPGZ ZIJFP 
KEFGJ IMKHX WIYDC CTAUE EDTFK HUNFZ 
HSGRG EGJKL IBWXW DVBBO WTDXS TVWMT 
FBDJZ IYZBE XXXXX 


c. There are no long polygraphic repetitions in evidence. An isomorphic search,” however, uncovers 
several isomorphic sequences indicated by the dotted lines above; these are grouped into the following 
two sets of isomorphs: 


Set “A” Set “B”’ 
(2) LHJJTYZLDXZHY (8) DFGOOBD 
(8) PG@GZZIJFPKEFGJ () TAUEEDT 
(YY) DVBBOWTDXSTVW 


If these isomorphs are causal isomorphs, i.e., isomorphs produced by the different encryptions of identical 
plaintext sequences, then the relationships between corresponding letters of the isomorphs reflect the 
relationships between different juxtapositions or slides of a cipher component against a plain component; 
these relationships, latent in the isomorphs, may be made patent through the mechanics of indirect 
symmetry. 

d. The partial chains derivable from these isomorphs are given below: 


a6: LP HG YJIZF TI DK XE 

ey: LDXS HV JB Z2TO YW 

By: PD GV ZB TO JW FT KX ES 
é-e: BDT FA GU OE 


Using the graphical method of indirect symmetry, these partial chains may be amalgamated into the 

diagrams shown in Figs. 9a and b, below. We note in Fig. 9a the _/1 relationship of the letters XZ, ST, 
2 

OP, and EF, and conclude that the cipher component must be a keyword-mixed sequence. We now 

expand the diagram of Fig. 9a by placing the W in position diagonally ahead of the XZ, and we duplicate 

the remaining letters in their proper position with respect to the W just placed a moment before; this 


YW YW Y W 
ed ; H(V) 
JB JB_Y@ JB_ YW). 
LDXS HV LD@®s LD@®s G 
2.00 ; @TOJB @TOJBU 
PKE G PKELDXS PKELDXS 
FI U FI ZTO Fl 2.90 
A eae A PKE A PKE 
Ficur: 9a Fil Fil 
A A 
Figure 9c Fieure 9d 


1 For a systematic method of searching for isomorphs, see footnote 7 on p. 
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is shown in Fig. 9c. This facilitates placing the diagram of Fig. 96 into the array (on the basis of the VWXZ 
. diagonal), resulting in the final diagram shown in Fig. 9d. From this latter figure, the original cipher 
component, minus 5 letters, may be chained out: 


12 8 4 5 6 7 8&8 9 10 11 12 13 14 15 16 17 18 19 2 21 22 2 24 25 26 
BEFGJK..OP.STVWXZHYD.AULI. 
Our old friend HYDRAULIC. 


e. We have the sequence for the cipher component, but now what? We could assume the plain 
component to be the normal sequence, direct and then reversed, and we could convert the first few 
cipher letters into their plain-component equivalents on these hypotheses and then complete the plain- 
component sequence; if we are correct in our assumption, a plaintext word would be revealed on one 
generatrix, another word on a different generatrix, etc. We could also assume the plain component to be 
the same as the cipher, in the same or in the reverse direction, and we could complete the plain-com- 
ponent sequence accordingly. All of these attempts fail, so it means that we are faced with a plain 
component of unknown composition. We have the cipher component at hand, it is true, but unless we 
know or can deduce the motion of the cipher component,'* it will be impossible for us to convert the cipher 
text into monoalphabetic terms; in other words, the original cipher is already reduced as far as it will go. 
Plaintext assumptions are now an absolute necessity. 

f. It can be seen by referring to the two sets of isomorphs in sub-par. c that Set ‘‘A’”’ has the com- 
plete idiomorphic pattern for COMMUNICATION, and that Set ‘‘B” has the idiomorphic pattern contained 
in ARTILLERY. If the now known cipher component is set down and the plaintext equivalents for the 
first occurrences of the assumed COMMUNICATION and ARTILLERY are recorded in the rows labelled 
P, and P, of the diagram below, direct symmetry of position will of course apply, provided that there 


Cc: HYDRAULICBEFGJKMNOPQSTVWXZ 
P, ONA Cc M U TI 


P, R E TTI A LY 


is a tie-in letter between the sequences; there happen to be three such letters, so that the plain com- 
ponent may be expanded as follows: 


ONA.LYC......M.R.....UE.TI 


Since there are manifested the phenomena of a keyword-mixed sequence in the plain component, we may 
further expand the sequence into the following: 


ONA.LYCDFGHJKM.R.....UE.TI 


If the key word for the sequence cannot be guessed from this partial sequence, we might finish the solu- 
tion by a modification of the method indicated in subpar. 1lc(1), with the difference that, in this case, 
not only will some of the cipher letters not have plain-component equivalents, but also that the plain 
component itself will have gaps in its sequence in the plain-component completion diagram. After the 
key word (QUESTIONABLY) for the plain component has been recovered, the solution can be completed 
by the generatrix method, keeping in mind the reconstruction of the message key as a means of quick 


18 See in this connection subpar. 71d on p. 175 of Military Cryptanalytics, Part II. 
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analysis after a few letters of the key have been derived. The complete decipherment of the message 
is shown below: 


Ss T R I 
LHJJT YZLDX ZHY|PH ZFIOCX LI|IMDF GOOBD 
COMMU NICAT IONIWI THIFIR STIART ILLER 
K E W H I L 
PIF QXX| QGiIYJP RX¥GJIG LTS RIM KS|IPGZ ZIJFP 
YIWILL| BE|JTHR OUGH/IC ORPS|A NDICOM MUNIC 
E T H E 
KEFGJ| IMKHiX WIYDC|CTAUE EDTFIK HUNFZ 
ATION| WITHiIS ECONDI ARTIL LERY|T HROUG 
I R 0 N I 
HISGRG EGJKiL IBWIXW]| DVBBO WTDXS TVWIMT 
HIDIVI STION(S TOPINO| COMMU NICAT IONAF 
S 
FBDiJIZ IYZBE XiX XXX 
TERIMI DNIGH T 
Figure 10 


The key for the message, under Q, as the index letter, is "STRIKE WHILE THE IRON IS . 
(HOT?) "#9 

g. In connection with the solution of the problem in this paragraph, let us take a closer look at the 
isomorphs listed in subpar. c. These are given below, together with their plaintext equivalents: 


Set “cA Set “B” 
COMMUNICATION (AVR TILLER(Y) 
(2) LHJJTYZLDXZHY (6) DFGOOBD 
(8) PGZZIJFPKEFGJ (:) TAUEEDT 
(7) DVBBOWTDXSTVW 


In case it had escaped attention before, note the ciphertext fragments XZHY, EFGJ, and STVW at the ends 
of the isomorphs of Set ‘“‘A’”’. These three tetragraphs, transparent in the cipher text, are actually frag- 
ments of the keyword-mixed sequence constituting the cipher component. The reason for their presence 
is not hard to find: the plaintext equivalent of the isomorphs ended with TION and the letters TION 
happened to be a fragment of the keyword-mixed sequence constituting the plain component. (Note 
also, from Set “B’’, that AU must also be in sequence in the cipher component.) This information would 
have been of assistance to us in the chaining process pursued in subpar. d; for pedagogical reasons, 
however, we delayed drawing attention to this situation until now. Needless to say, this situation or a 
recognizable variation of it could be of considerable assistance in the solution of a difficult problem of 
only a few messages in actual operations. 

h. One more very important facet of isomorphism should be discussed at this point. Let us suppose 
that we have recovered the cipher component of the message under study through the exploitation of 
isomorphs as just demonstrated; but let us suppose that the two plaintext assumptions (COMMUNICATION 
and ARTILLERY) were insufficient to disclose enough of the sequence for the plain component to permit 
its facile recovery.” Additional plaintext assumptions are necessary, but we seem to have milked the 


19 Hot. 
20 This would be the case if the plain component were not a keyword-mixed sequence but were, let us say, a trans- 


position-mixed sequence. 
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cipher text dry with the two cribs we have already placed. The problem confronting us is how to make 


further “educated guesses” that might display a trace (or more, we hope) of erudition. 
i. Since the cipher component has become a known sequence, let us set it down, numbering its 
elements serially from 1 to 26, as follows: 
12 3 4 5 6 7 8&8 9 10 JL 12 18 14 15 316 17 18 19 20 21 22 23 24 25 26 


HYDRAULICBEFGJIKMNOPQSTVWXZ 


Let us first replace the letters of the cipher text by their numerical equivalents according to the 
HYDRAULIC sequence. We will then take a delta or lateral difference stream” from these numerical 


"values, by subtracting each number from the following one;” however, instead of recording the numerical 


difference, we will record the literal equivalent of this numerical difference according to the HYDRAULIC 
sequence above. The result of this process is shown in Fig. 11, below: 














LHJJT YZLDX ZHYPH ZFOCX LIMDF GOOBD 
71442 2 67 3 23 2% 21 2 19 1 «2% 1218 9 2 7 8 1 8 12 18 18 18 10 3 
QG2zi UWLTT HHHNI XFUNM IHIGC HAZOP, 
PFQXX QGYJP RX¥GJG LTSRM KSPGZ ZIJFP 
19 12 20 25 2 2 19 2 14:19 4 2 13 14:13 «67 22 2 4 «16 «15 21 39 13 2 «2H OB OM 12 19 
HM PIAZ SPKFA ESJHX QKXCF XUWQGQ ZIUWL 
KEFGJ IMKHX WIYDC CTAUE EDTFK HUNFZ 
15 W112 18 140 8 6 15 1 KCB BCC GK CK UO Bo 12 15 sds «sCs«12s 286 
2 TH HH QIXFW XBQHU ZGCHA ZOPMD FAESJ 
HSGRG EGJKL IBWXW DVBBO WTDXS TVWMT 
1 2113 4 «13° «Lb 13 14:15 7 8 10 24 25 2 3 2 10 10 18 2 22 8 2 21 22 23 2 16 22 
eH QONC WYHHO HYJHX AQGZI UWLTT HHHOU 
FBDJZIYZBE XXXXX 
12210 3 14 2 8 2 2 10 11 25 25 25 25 25 
MWPEF IQWBH JZZZZ 
Ficurs 1} 


5 


gj. We can see, by comparing Fig. 11 with the original plain text as given in Fig. 10, that the delta 
strearh has revealed adi of the polygraphic repetitions of trigraphs or better in the underlying plain text.” 
Note the IXF repetition in the delta stream, which means that the ciphertext sequences PHZF and 
IMKH must represent the same plain text (probably the word WITH, since it is a four-letter repetition 
following COMMUNICATION); the PHZF and IMKH sequences are actually isomorphic, but we were unable 
to recognize them as such until now. Also note the delta repetition FAESJH, which means that the 
ciphertext sequences YJPRXGJ and KHUNFZH (an isomorphic pair whose isomorphism we were unable to 
trust before, because of a lack of sufficient corroborative values in the isomorphic repetition pattern) 
must represent the same plain text (in this case, the assumption of the word THROUGH would be per- 
mitted). Note further the HH digraphic fragment in the delta stream, which means that GJK, must 
represent ION, (from COMMUNICATION); since this is not preceded by T,, the assumption of 5, and there- 
fore DIVISION is encouraged. With these plaintext values and those which follow as a direct result 
of our analysis thus far, it would be a simple matter to reconstruct the plain component almost in toto 
and the plain text of the message in its entirety. 

18. Additional remarks.—a. One of the practical difficulties in employing systems in which the 
keying process shifts according to word lengths is that in handling such a message the deciphering clerk 
is often not exactly certain when the termination of a word has been reached, which results in the loss 
of time and effort. For instance, in deciphering a word such as INFORM, the clerk would not know whether 
he now has the complete word and should shift to the next key letter or not; the word might be INFORMS, 


2t The application of delta stream techniques to the solution of digital cipher systems has been illustrated in Chapters 
XI and XII of Military Cryptanalytics, Part 71. 

22 Jn this process, subtraction is performed mod 26: i.e., if we are to subtract a large number from a smaller, we add 
26 to the smaller before subtraction. For example, 1-7=(1+26)—7=20=Q in the scale above. 26 is equivalent to 6 
in this modulus, so that 14-—14=9§=Z. 

3 The plaintext repetitions are foreshortened by one letter in the delta stream; e.g., COMMUNICATION, a 13-letter 
word, appears as a 12-letter sequence in the delta stream. 
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INFORMED, INFORMING, INFORMAL, INFORMATION, etc. The past tense of verbs, the plural of nouns, 
and terminations of various sorts capable of being added to word roots would give rise to difficulties, 
and the latter would be especially troublesome if the messages contained a few telegraphic errors to 
boot. Consequently, word separators are often adopted to circumvent this source of trouble.“ These 
separators usually consist of an infrequent letter, such as X, or Q,, which is placed after every word of 
the plain text and is encrypted along with the rest of the message.” 

(1) When word separators are employed and this fact is once suspected or discovered, their presence 
is of as much aid to the cryptanalyst in his solution as it is to the clerks who are to decipher the mes- 
sages. As an example, let us study the following cryptogram: 


IWJIR NPTXS FIWCM SDFEW SBLXQ LBHFL TYIFD UVLUL JRLYG HRZyYI 
FMZXD GRMCR SWPTX SFIWC KAMWZ XLXWQ BAARN FLTVQ AMQDZ LVUQK 
GQZZO IHMIR OLOMI DXZFG PLKIS CAHQZ MGNWX BTIYQ BDLTP NPQUD 
LYLGU FINSX LOHZA SXAFD XTFIZ PJXMM QDCPE WYIBZ QGHBH RXDTX 
IOOLU IKVGC MGITZ HWDRG GIWMY RZWNP FDCEM YFASY PJWHX JZGWW 
XFQXO TMCNA UUEJJ IKVGH RZYIP MWIDL RDCWI PGAQC SACWP 


Collateral information indicates that the cryptosystem involves monoalphabetic encipherment by word 
lengths, a word separator being used to signal the change to a new key letter; the key letters themselves 
form a plaintext word as a mnemonic key. 

(2) If the encipherment is by word lengths and a word separator is used, the average length of words 
should be 6.2 letters. Since a key word is used to control the selection of alphabets, if a polygraphic 
repetition of significant length is present in the cipher text, the interval between the first and second 
occurrences should give a fair indication of the length of the key, unless there are repeated letters in the 
key and these polygraphic repetitions happen to be produced by identical key letters in different posi- 
tions in the key word. We note the 8-letter repetition PTXSFIWC at an interval of 56 letters; this would 


seem to indicate that the key word is — 2 or 9 letters long, give or take a letter. Since there is another 


6.2 


polygraphic repetition present, GHRZYI at an interval of 224 letters, the division “ 36=4 X9 furnishes 
corroboration of the length of the key word, and dispels fears that these repetitions may have been 
produced by identical key letters in different positions in the key word. 

(3) When word separators have been used, the first and last letters of long polygraphic repetitions 
are most likely to be word separators; *° consequently, in the case of the first repeated sequence, 
PTXSFIWC (representing either the second or third word of the message), P, and C, should represent 
the word separators. Now if the cipher text of the message is written out in lines of 50-60 letters or so 
using the repeated sequence PTXSFIWC as a sort of base, we might be able to pick out the successive 
word separators; this is shown in the diagram below: 


IWJ Cee ae LBHFLTYIFDUVLULJRLYGHRZYIFMZXD 


eee 


CRNCRSWPTESFIMEKAMNZXLAN BAARNFLTVQAMQDZLVUQKGQZZ0IHMIROLOMID 






XZFGPLKISCAHQZMGNWXBTIYQBDLTPNPQUDLYLGUF INSXLOHZASXAFD 
XTFIZPJXMMQDCPEWY IBZQGHBHRXDTX 1 OOLUIKVGCMGITZHWD 
se caiheaa ee Se ie 
LRDCWIPGAQCSACWP 


Figure 12 


% See the discussion on word separators in subpar. 100d of Military Cryptanalytics, Part II. 

25 Occasionally, unenciphered word separators are encountered, there being employed for this purpose a character not 
otherwise used in the cryptographic scheme. 

36 The occasional exceptions would be cases of the partial repetitions arising from pairs of words such as INFORMS 
and INFORMATION, wherein the initial letters of the ciphertext repetitions would represent a word separator, but the 
final letters would represent M,, the last letter of the root word. 
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‘ Note that the next-to-last separator, I,, was preferred to a preceding Z, (also a possibility as a word 
_ Separator) because of the final letter of the GHRZYI repetition. With the word divisions now known, it 
‘is an easy matter to make plaintext assumptions based on word lengths and idiomorphs; the rest of the 


solution is left to the reader as an exercise. 


(4) The foregoing example involved but a single message and a relatively short message key so that 
during the encryption five complete cycles of the message key were employed; it was this re-use of the 
keying sequence that permitted a solution. It is obvious that, regardless of the length of the key, if 
we had five or six messages or so in the same key, we could have written them out over one another and 
by careful scrutiny we could have determined the word separators much in the same fashion as was 


' illustrated by the diagram of Fig. 12, above. 


6, The systems thus far discussed are all based upon word-length encipherment using different 
cipher alphabets. Words are markedly irregular in regard to this feature of their construction and thus 
aperiodicity is imparted to such cryptograms. But variations in the method, aimed at making the 
latter somewhat more secure, are possible. Instead of enciphering according to natural word lengths, 
the irregular groupings of the text may be regulated by other agreements. For example, suppose that 
the numerical value (in the normal sequence) of each key letter be used to control the number of letters 
enciphered by the successive cipher alphabets. Depending then upon the composition of the key word 
or key phrase, there would be a varying number of letters enciphered in each alphabet. If the key word 
were PREPARE, for instance, then the first cipher alphabet would be used for 16 (=P) letters, the second 
cipher alphabet, for 18 (=R) letters, and so on. Monoalphabetic encipherment would therefore allow 
plenty of opportunity for telltale word patterns to manifest themselves in the cipher text. Once an 
entering wedge is found in this manner, solution would be achieved rather rapidly. 

c. If the key of the system described in the foregoing subparagraph is short, and the message is 
long, periodicity will be manifested in the cryptograms, so that it would be possible to ascertain the 
length of the basic cycle (in this case, the length of the key) from a single message, despite the irregular 
groupings in encipherment. The determination of the length of the cycle might, however, present dif- 
ficulties in some cases, since the basic or fundamental period would not be clearly evident because of 
the presence of repetitions which are not periodic in their origin. For example, suppose the word PREPARE 
were used as a key, each key letter being employed to encipher a number of letters corresponding to 
its numerical value in the normal sequence. It is clear that the length of the basic period, in terms of 
letters, would here be the sum of the numerical values of P(=16)+R(=18)+E(=5)+ . . ., totalling 
79 letters. But because the key itself contains repeated letters and because encipherment by each key 
letter is monoalphabetic, there would be plenty of cases in which the first letter P would encipher the 
same or part of the same word as the second letter P, producing repetitions in the cipher text. The 
same would be true as regards encipherments by the two R’s and the two E’s in this key word. Conse- 
quently, the basic period of 79 would be distorted or masked by aperiodic repetitions, the intervals 
between which would not be a function of, nor bear any relation to, the length of the key. Cases are 
frequently encountered in which a fundamental periodicity is masked or obscured by the presence of 
ciphertext repetitions not attributable to a fundamental cycle; the experienced cryptanalyst is on the 
lookout for phenomena of this type, when he finds in a polyalphabetic cipher plenty of repetitions but 
with no factorable constancy which leads to the disclosure of a short period. He may conclude, then, 
either that the cryptosystem involves several primary periods which interact to produce a long re- 
sultant period, or that it involves a fairly long fundamental cycle within which repetitions of a non- 
periodic origin are present and obscure the phenomena manifested by repetitions of periodic origin.” 

d. A logical extension of the principle of polyalphabetic encipherment of variable-length plaintext 
groupings is the case in which these plaintext groupings rarely exceed 4 letters, so that a given cipher 
alphabet is in play for only a very short time, thus breaking up what might otherwise appear as fairly 
long repetitions in the cipher text. 


37 See also in this connection footnote 8 on p. 26 of Military Cryptanalytics, Part IT. 
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(1) For example, suppose that the letters of the alphabet to be used as key letters are arranged in 
the order of their relative frequencies in English plain text, and are set off into four groups of 5, 6, 7, and 
8 letters, respectively, as follows: 


ETNRO AISDLH CFPUMYG WVBXQKJZ 
Group 1 Group 2 Group 3 Group 4 


Suppose that a key letter in Group 1 means that one letter will be enciphered; a letter in Group 2, 
that two letters will be enciphered; and so on. Suppose, next, that a rather lengthy phrase were used 
as a key; for example, I KNOW NOT WHAT COURSE OTHERS MAY TAKE BUT AS FOR ME GIVE ME 
LIBERTY OR GIVE ME DEATH. Suppose, finally, that each letter of the key were used to control the 
number of letters to be enciphered by the selected alphabet, according to the scheme outlined above. 
Such an enciphering scheme, using the HYDRAULIC . . . XZ primary cipher component sliding 
against a normal plain component, would yield the following groupings: 


Grouping: 2 4 #11 4 111 4 2 2 1 3 1 3 142 41412 
Key: I K NO W NOT W H AT C OU RS EOQTH 
Plain: TW ENTI E T HREG I M E NTHE AD QU A RTE R SNO W LOC AT ED 
Cipher: HR PYIV S E AKYR X R Z ENAY HR SX T ZYG C WPQ Z UC GO K AR 
Grouping: 1 12 3 2 G12 4 i 4 a. Al ge 8 3 11 
Key ERS M A Y¥ TA K_ E B U TA S F OR 
Plain N E AR HEA DQ UAR T ER SOFF O RTYS ECO N DR EG IME N T 
Cipher W I SF VQM IS TYP K CT LDQQ X HDIY BIQ C IT XH QWM A V 


(2) Here it will be seen that any tendency for the formation of lengthy repetitions would be counter- 
acted by the short groupings and quick shifting of alphabets. Before a long plaintext passage can be 
enciphered by exactly the same sequence of key letters, an interval of exactly 135 letters (the sum of 
the values of the letters in the key phrase) or a multiple thereof must intervene between the two occur- 
rences of the plaintext passage.?® When, however, a repeated plaintext passage is at an interval of only 
one or two letters off from 135 or a multiple of 135, there can occur in the system under discussion a 
phenomenon of intermittent coincidences; i.e., coincidences not among all the ciphertext letters repre- 
senting the repeated plaintext passage, but among only a few of these ciphertext letters. As an example, 
let us consider the following message beginnings of two messages in flush depth: 





Grouping: 2 4 11 4 #114 4 2 2 1 8 1 8 24 2 21 1 21 2 
Key: i K NO W NOT W H A TT C OU RS EOTH 
Msg “A”: TW ENTI E T HREG I M E NTHE AD QU A RTE R SNO WLOC ATED. 
Cipher “‘A’’: HR PYIV S E AKYR X R Z ENAY HR SX T ZYG C WPQ Z UC GO K AR 
Msg “B”: FI FTYF I R STDI V I S IONH EA DQ U ART E RSI S MOVING. 
Cipher ‘‘A”’: GM QIGQ X C MNHU F Z J UFEA AH IS M CZY T VWI TLC UZCL 


The word HEADQUARTERS is offset one position to the right in Message ‘‘B” with respect to its position 
in Message “‘A”’. (This same situation would arise if the second occurrence of HEADQUARTERS in Message 
“‘A”’ were at an interval of 136 letters from the first occurrence, or 271 letters, or any other multiple of 
135 plus one more letter.) If we set down the cipher equivalents of the two occurrences of HEADQUARTERS 
under the plain text, we have the following: 


24 Note that, in the case of this particular key, two occurrences of a 14-letter plaintext passage could receive identical 
encipherments at two different positions of the key at which there are identical fragments (GIVE ME) in the key phrase; 
the intervals between these repeated ciphertext sequences would have nothing to do with the length of the period. 
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We notice that the cipher equivalents agree only in the first, third, fifth, eighth, ninth, and twelfth 


. letters. The repetitions here extend only to one or two letters; longer repetitions can occur only excep- 


tionally. The two encipherments yield only occasional coincidences, i.e., places where the cipher letters 
are identical; moreover, the distribution of the coincidences is quite irregular and of an intermittent 
character. This phenomenon of intermittent coincidences, involving coincidences of single letters, pairs 
of letters, or short sequences (rarely ever exceeding pentagraphs) is one of the characteristics of this 
general class of polyalphabetic substitution, wherein the cryptograms commonly manifest what appears 
to be disturbed or distorted periodicity. 

e. As has already been noted, in aperiodic systems wherein the key is determined or generated 
apart from the plain text being enciphered (as is the case of the example in the foregoing subparagraph), 
cryptographic depth is possible; therefore the analyst may be able, if keying conditions permit, to super- 
impose messages and solve the resultant superimposition. On the other hand, in systems wherein the 
plain or cipher text influences or governs in any way the selection of keys, cryptographic depth is usually 
impossible of establishment, except in very special circumstances. 

Ff. The essence of the systems described in this chapter really comprises monoalphabetic substitution 
in irregular, and usually small, segments; nevertheless, these segments were large enough to permit 
of their isolation and exploitation. As the size of these segments decreases, ultimately to units of single 
letters, so does the difficulty of solution increase—but not beyond the potentials of cryptanalysis, as 
will shortly be demonstrated. 
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14. General.—a. The systems treated in the preceding chapter incorporated simple methods of 
eliminating or avoiding periodicity by enciphering variable-length groupings of the plain text, using 
constant-length keying units; the essence of those systems was really monoalphabetic encipherment by 
sections,’ the sections comprising irregular-length plaintext groupings. In subpar. 2a, however, it was 
pointed out that periodicity can also be suppressed by applying variable-length keying units to constant- 
length plaintext groupings; the essence of such systems is polyalphabetic substitution applied to the 
plaintext units (usually single letters). One such method consists in irregularly interrupting the keying 
sequence, if the latter is of a limited or fixed length, and recommencing it (from its initial point) after 
such interruption, so that the keying sequence becomes equivalent to a series of keys of different lengths. 
Thus, the key phrase BUSINESS MACHINES might be expanded, by a particular keying convention, 
into a series of irregular-length keying sequences, such as BUSI/BUSINE/BU/BUSINESSM/BUSINESSMAC, 
etc. Various schemes or prearrangements for determining the type or character of the interruptions 
may be adopted. Several typical methods will now be described. 

b. There are many methods of interrupting a keying sequence which is basically cyclic and which 
therefore would give rise to periodicity if not interferred with in some way. These methods may, however, 
be classified into six general cases as regards what happens after the interruption occurs. 

Case I: The keying sequence merely stops and begins again at the initial point of the cycle. 

Case II: Certain elements of the keying sequence may “stutter” or be repeated a fixed or a 
variable number of times. 

Case III: One or more of the elements in the keying sequence may be omitted from time to 
time irregularly. 

Case IV: The keying sequence irregularly alternates in its direction of progression? 

Case V: The keying sequence irregularly alternates in its direction of progression, and, in 
addition, certain elements of the keying sequence may be repeated one or more 
times. 

Case VI: The keying sequence irregularly alternates in its direction of progression, and, in 
addition, one or more of the elements in the keying sequence are omitted from time 
to time irregularly. 

c. The foregoing methods may, for clarity, be represented graphically as follows. Suppose the key 
consists of a cyclic sequence of 10 elements represented symbolically by the series of numbers 1, 2, 3, 
.. . @. Indicating an interruption by a vertical line,* we show in Fig. 13, below, the relationship between 


1 See in this connection subpar. 84b(1) on p. 220 of Military Cryptanalytics, Part I. 

2 In addition to these cases, a “‘septimum quid’’ could be listed, as a catchall for ‘everything else,’’ which includes 
progressions so irregular as to defy classification. 

3 It is to be noted that this fourth case could be treated as though it were a special form (with irregularly occurring 
small or large skips) of the third case. 

* What spectfically brings about the interruption is here not stated, nor for that matter does it concern us at the 
moment. Suffice it to say that, whatever the cause of the interruption, it is not a function of the plain or of the cipher 
text, but is in this case predetermined by an external convention with steps 3, 1, 6, 7, 5, 8, 2,4,9... 
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the letter at each position of the message and the identity of the element of the keying sequence in the 
six general cases discussed above. 


Letter No. 








12 3 4 5 6 7 8 9 10 11 12 18 14 15 16 17 18 19 20 21 22 23 24 25 
Key elements, CaseI: 12 3/1/123456/1234567)12345/123 
Key elements, Case II: 12 3/3)3 4567 8)8901234/4567 8|890 
Key elements, Case III: 1231517 89012/4567890/2345 6/890 
Key elements, Case IV: 12 3/2/3 4567 8)7654321123 456/543 
Key elements, Case V: 123/333 4567 8/8 765432/2345 6/654 
Key elements, Case VI: 12 3/5/789012/432109 8/0123 4/654 

Letter No. 26 27 28 20 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 BB 
Key elements, CaseI: 4567 8J12)/1234/123456789/12345. 
Key elements, Case II: 12345/56/6789|/I90123 45 67/78901. 
Key elements, Case HI: 12345/7 8)|0123/567890123/56789. 
Key elements, CaseIV: 2109 8/9 019876|789012345/43210. 
Key elements, CaseeV: 3210919 01/0987/789012345/543521. 
Key elements, Case VI: 32109]/1 2}43 21/3 4567890 1/3 2109. 

Figure 13 


Note that in Cases III and VI the amount of skip is here portrayed as being constant. This is not a 
necessary condition in these keying methods; the amount of skip could have consisted of irregular 
jumps as established by the keying convention employed. 

d. If we knew just when the interruptions take place, and if we also knew the exact nature of the 
effect of each interruption, then the successive ciphertext sections of encrypted messages in the fore- 
going six cases could be properly superimposed so as to be in true cryptographic depth. In the diagrams 
below, the digits in the top line represent the ten keying elements, while the numbers 1-50 underneath 
this line represent the positional identities of the first 50 ciphertext letters. 


12 3 4 5 6 7 8 9 ¢ 
(i 8° 73) 
(4) 
(5 6 7 8 9 10) 
(11 12 13 14 15 16 17) 
(18 19 20 21 22) 
CaseI (23 24 25 26 27 28 29 30) 
(31 32) 
(33 34 35 36) 
(37 38 39 40 41 42 43 44 45) 
(46 47 48 50. 


_1 2 3 4 5 6 7 8 9 


(1. 2- 3) 
(4) 
(5 6 7 8 9 10) 
+14 15 16 17) (ll 12 13> 
(18 19 20 21 22) 
CaseIl ->26 27 28 29 30) (23 24 25> 


(31 32) 
(33 34 35 36) 
—39 40 41 42 43 44 45) (37 385 
350... (46 47 48 49> 


5 These two points could have been determined either through physical compromise of a cipher machine incorporating 
such principles, or through the analytical compromise of a cryptosystem. 
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(4) 
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24 23) 
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8— 
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Obviously, if we did not know when or how the interruptions take place, then the successive sections of 
keying elements cannot be superimposed as indicated above. 

e. The interruption of the fundamental cyclic keying sequence usually takes place according to 
some prearranged plan or convention. The identity of the plaintext letters being enciphered might be 
involved in the determination of the interruption (as in plaintext interruptor systems) ; ° or the identity 
of the ciphertext letters might be a factor (as in ciphertext interruptor systems); or, finally, the inter- 
ruption of the fundamental cyclic keying sequence might be predicated upon a separate convention, 


® In the Wheatstone cipher device the interruption of the keying sequence of the 26 cipher alphabets used in sequen- 
tial progression is predicated upon the relative position in the plain component of a plaintext letter with respect to 
the position (in the plain component) occupied by the next plaintext letter to be encrypted. (See Chapter VIII in this 


connection.) 
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mechanism, or prearrangement, without regard to the plain text or the cipher text. Some basic methods 
of interruption will now be taken up, using a short mnemonic key as an example. 

15. Plaintext interruptor systems.—a. Suppose the correspondents agree that the interruption in 
the key will take place after the occurrence of a specified letter in the plain text, after which the key 
begins anew at its initial position.’ Since there is nothing fixed about the time the interruption will 
occur—it will take place at no fixed intervals—not only does the interruption become quite irregular, 
following no pattern, but also the method never reverts to one having periodicity. Let us assume that 
the correspondents have agreed upon R, as the interruptor letter, and that they are using the normal 
sequence for the plain component and the HYDRAULIC . . . XZ sequence for the cipher component. 
If the mnemonic key phrase is BUSINESS MACHINES, this key would be interrupted by the occurrences 
of R, as in the following example: 


Key: 


Plain: 
Cipher: 


eH 
~ DWH 
GHG 
wo H 


. Key: 
Plain: 
Cipher: 


HW WP wD 


RQnta «Bq oFG 
OHM OHM ren 
mw KwNnNwW 
qu2az s7CG MHS 
GHNnN NAS 
DGHNM KDE 


 wvToH 
QVM NOAA Wawswz 
crc sWWOwM wHE 
W7IH KAM GHN 
VUHwW ATH YGVHN 
GH WOR WOE 
Crn PrP OCO2P 
WOaQ ana 
nese > mG nO L 
KDW FLOW 
Wr ww nren 
oC MAH 
rmwN OnwW 
<< CH 
Azza arn 
THE 
Dos 
o2ZP 
amya 
xO 
— AH 


Key: 
Plain: 
Cipher: 


Heo 2aP ma RAY 
BSBnaq F2DM GHC 
G4GHHnH BHnHN HAM 


OHW 


I 
R 
x 


 vTOH 
WOH 


The final cipher text, in groups of five letters, would be the following: 


BOLYR PJDRO JKXKJFYXSX DJUPS YIYODP 
YFXUR AFAEN MJIJVB_ OLYRP JDROJ KXDGD 
XGUFD JUPSY IWJTU. 





It will be noted that the two long polygraphic repetitions are at intervals of 44 and 34, respectively; 
which intervals have nothing in common with 16, the length of the basic, uninterrupted period. 


b. Instead of employing an ordinary plaintext letter as the interruptor letter, one might use a 25-letter 
plain component, combining I with J, and then use the 26th character (J) as a null plaintext letter 
which is inserted at random by the encipherer to serve as the interruptor letter. Note the following 
example: 


Key: BUSINESSMABUSINESSMACHINESBUSBUS 
Plain: PR ROCE DTOJROADIUNCTIONSIXTWOJFIVEJ 

c. It is obvious that repetitions would be plentiful in cryptograms of this construction, regardless 
of whether a letter of high-, medium-, or low-frequency is selected as the signal for key interruption. 
If a letter of high frequency is chosen, repetitions will occur quite often, not only because that letter will 
certainly be a part of many common words, but also because it will be followed by words that are fre- 
quently repeated; and since the key starts again with each such interruption, these frequently repeated 
words will be enciphered by the same sequence of cipher alphabets. This is the case in the first of the 
two foregoing examples. It is clear, for instance, that every time the word ARTILLERY appears in the 
cryptogram the cipher equivalents of TILLERY must be the same. If the interruptor letters were A, 
instead of R,, the repetition would include the cipher equivalents of RTILLERY; if it were T,, ILLERY, 
and so on. On the other hand, if a letter of very low frequency were selected as the interruptor letter, 
then the encipherment would tend to approximate that of normal periodic substitution, and repetitions 


would be plentiful on that basis alone. Of course, the intervals between the repetitions in any of the 


7 This is Case I of subpar. 140. 
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wegoing cases (except perhaps that in which the plaintext interruptor is a letter of very low frequency) 
ould be markedly irregular, so that periodicity would not be manifested. 
_ 16. Ciphertext interruptor systems.—qa. In the systems of the preceding paragraph, a plaintext 
jetter serves as the interruptor letter. But now suppose the correspondents agree that the interruption 
“in the key will take place immediately after a previously agreed-upon letter, say Q,, occurs in the cipher 
text. The key would then be interrupted as shown in the following example: 


Key: BUS INESSMACHINESBUSINESSM 
Plain: AMMUNITIONFORFIRSTARTILLE 
Cipher: BOLYRPJDROJKXTPFYXSXBPUUQ 
Key: BUS INESSMACHINBUSINESSMACHBU 
Plan: RYWILLBELOADEDAFTERAMMUNITIO 
Cipher: HRNMYTTXHPCRFQBEJFIELLBONQOQ 
Key: BUSINESSMACHBUSIWNESSMA 
Plan: NFORTHIRDARTILLERYSTOP. 

Cipher: VECXBODFPAZQONUFICGJRQ 

‘The cipher text in 5-letter groups is as follows: 
BOLYR PJDRO JKXTP FYXSX _BPUUQ HRNMY 
TTXHP CRFQB EJFIE LLBON OQ@VE CXBOD 
FPAZQ ONUFI CGJRQ 


b. In the foregoing example, there are no significant repetitions; such as do occur comprise only 
digraphs, several of which are purely accidental. But the absence of significant, long repetitions is itself 
. purely accidental, for had the interruptor letter been a letter other than Q,, then the phrase AMMUNITION 
FOR (which occurs twice) might have been enciphered identically both times. If a short key is employed, 

repetitions may be plentiful. For example, note the following, in which S, is the interruptor letter: ° 


Key: BANDSBANDSBANDSBANDSBANBANDSBBA 
Plain: FROMF RFIVET RFIFTEENWILLBE. 
IIDACB Eel 


OU OFOU I 
Cipher: K TAK ZWX NZWX DKWSJOGEUSEC 


OW 


c. This last example gives a clue to one method of attacking this type of system. There will be 
repetitions within short sections, and the interval between them will sometimes permit ascertaining the 
length of the basic key. In such short sections, the letters which intervene between the repeated sequences 
may be eliminated as possible interruptor letters. Thus, in the foregoing example, we can deduce that 
the length of the basic key is 5 letters, and that the cipher letters A, C, B, and N may be eliminated as 
interruptor letters. By extension of this principle to the letters intervening between other repetitions, 
one may more-or-less quickly ascertain what ciphertext letter serves as the interruptor.® 

d. The ciphertext interruptor might be a letter which is not otherwise used in the cryptographic 
scheme; for example, the plain component might be a 25-letter sequence (combining I and J) and the 
cipher component a 25-letter sequence excluding, let us say, Z. This letter Z may then be inserted in 
appropriate places in the cipher text to signal the interruptions in the keying cycle. In some cases such 
a special interruptor letter may be used in addition to a ciphertext interruptor which arises from the 
bona fide encryption of a plaintext letter, as a means of insuring that interruption of the keying cycle 
will take place frequently enough to suit the cryptographer or his procedures-prescribing superiors. 


8 Note that the periodic repetitive phenomena manifested would also have arisen in a plaintext interruptor sys- 
tem, if the interruptor had been, let us say, A,—or, for that matter, any other letter not present in the fragment FOURFI 
VETOFOURF I. ; , 

§ The method described in this subparagraph may also be applied in the case of plaintext interruptor systems, with 
certain modifications. 


206-687 O~ 77-2 29 _—SEGRET™ 


~SECRET 


(For that matter, there is nothing to bar the use of two or more letters as interruptors in the usual 
manner, in either plaintext interruptor or ciphertext interruptor systems.) 

17. Systems employing externally generated or determined keys.—ca. In subpars. 36 and f we have 
seen two examples of keying procedures which do not depend upon conventions affiliated with identities 
of plaintext or ciphertext letters, but which are established by an independent, external keying convention. 
The keying methods of subpar. 38, if modified to incorporate variable-length polyalphabetic keying units 
(as contrasted with the variable-length monoalphabetic keying units illustrated in that example), could 
take on a form such as the following: 


S IG GNA NALS ALSIG L SI IGN GNAL NALSI A LS SIG IGNA GNALS 
1 12 123 #1234 #12345 1 12 123 #1234 #12345 1 12 1235 1234 12345 
N AL LSI SIGN IGNAL G NA ALS LSIG SIGNA I GN NAL ALSI  LSIGN 
lL 12 123 1234 #12345 1 12 123 #1234 #12345 1 12 123 1234 12345 
S IG GNA NALS ALSIG L SI _ IGN etc. 

1 12 123 1234 12345 1 12 123 


Similarly, the keying method of subpar. 3f, modified to embrace the aspect of variable-length poly- 
alphabetic keying units, could be transformed into one of the following, among other possibilities: 


(1) DE F/E/C DE F/LMN O/A BPR S T/A B/T/I J/O P Q/N 0/0 P O/F GH I/. 
(2) DE C/E/C LA R/LAR A/A R/R A T/A T/T/I 0/0 N O/N 0/0 F I/F IND/. 


b. The foregoing methods have as their purpose the establishment of keys of fair length from a 
short mnemonic key. There are other simple methods for accomplishing this, as illustrated in the examples 
which follow. Let us consider the mnemonic key HYDRAULIC, and derive from it a numerical key: 


HYDRAULIC 
5 2 


49 3 7 1 8 6 


We may now take the key letters in numerical-key order, and in groupings as determined by the numeri- 
cal key, so that the original key of only 9 letters is expanded to one of 45 letters. Thus: 


(1) A/C H/D RA/HYDR/ICHYD/LICHYD/RAULICH/ 
ULICHYDR/YDRAULICH/ 


Two other methods of deriving 45-element key sequences from the basic 9-letter key word are shown 
below: 


(2)H YDR/YDRAULICH/DRA/RAULICH/A/ 
ULICHYD ae . CHYD/ICHYD/CH/ 
(3) HY DR aay DRAULICHYDAHAHYDRAULI/ 
HYDRAUL/HYDR /HYDRAUA Y/ 


Method (2) is essentially the same as (1), except that the key fragments are taken in the order in which 
they appear in the key word. Method (3) involves taking the successive sections of the numerical key, 
these sections terminating with the successive numbers 1, 2, 3, . . . of the numerical key.!° 

c. Many other methods exist for the establishment of keys consisting of variable-length keying 
units. Furthermore, some of these methods merge into the domain of methods of lengthening or extend- 
ing keys in general, apart from any considerations of variable-length keying units. Several of the most 
important of these methods will be discussed in subsequent chapters of this text. 

18. Solution when known cipher alphabets are employed.—a. (1) Let us suppose that a particular 
cryptosystem has been in use for some time, and that the general nature of the system and the cipher 


10 This method is equivalent to an interrupted-key columnar transposition system. See in this connection subpar. 
51h on p. 89 of Military Cryptanalytics, Part I. 


—~SEORET— 30 


Be 


—SECRET 


alphabets have become known, either through successful cryptanalysis or through light-fingered tech- 
‘niques coming under the formal term of ‘physical compromise,’ which includes among its manifold 
tachydactylurgic aspects that which has been referred to colloquially as ‘wastebasket cryptanalysis.” ! 
Only the specific key to messages remains unknown. The cipher text is examined for repetitions, and an 
attack is made on the basis of searching for a probable word. Thus, taking the cryptogram in subpar. 
15a as an example (quoted here below for convenience), suppose the presence of the word ARTILLERY 
is suspected. 


oy 


SX DJUPS YIYDP 
RP JDROJ KXDGD 


> 
Q10 
axr 
ma 
umn 
Gy 
aya 
uPyo 
nny 
Kz O 
He c 
sau; 
Cy Cy de 
Hom 
cwa 


Attempts are made to locate this word, basing the search upon the recognition of an intelligible key; 
we will assume in this case that the cipher component is the HYDRAULIC . . . XZ sequence sliding 
against the normal sequence for the plain component. 


(2) Beginning with the very first letter of the message, we juxtapose the word ARTILLERY against 
the cipher text and ascertain the key letters. Thus: 


Key: BHJIQPIBFU 
Cipher: BO LYRPJDR 
Plain: ARTILLERY 


Since this “key” is certainly not intelligible text, the assumed word is moved one letter to the right 
and the test repeated, and so on until the 19th position in the text is reached.” 


Key: SIBUSINEB 
Cipher: SX DJUPSYI 
Plan: ARTILLERY 


(3) The sequence BUSINE suggests BUSINESS; moreover, it is noted that the key appears to be 
interrupted both times by the letter R,. The key may now be applied to the beginning of the message, 
to see whether the whole key or only a portion of it has been recovered. Thus: 


Key: BUSINESSBUSINES 
Cipher: BOLYRPJDROJKXKJ. 
Plans AMMUNITIUMTHIET 


(4) It is obvious that BUSINESS is only a part of the key. But the first word of the message is 
plainly AMMUNITION. When this is tried, the key is extended to BUSINESS MA . . . This key crib 
is now slid through the rest of the cipher text and the remainder of the message is quickly deciphered 
and the entire key recovered. 


1! This is really not stealing. For the pure in heart, this should be thought of as conversion of raw data, and that the 
parties so generously supplying these raw data are, unknowingly, cooperating in government work. 

42 In actual practice, the search for the placement of the probable word would have been accomplished by means of 
the following diagram (see in this connection subpar. 22d on pp. 41-42 of Military Cryptanalytics, Part II): 








BOLYRPJDROJKXKKJFYXSXDJUPSYIYDP... 
AIBOLYRPJDROJKXKJFY XDJUPSYIYODP 

Ri HMEGYVFGHVWIWVSETI KYRENEFY 

T JCEZSBEXSTUTSPCUY GZYCKCBZ 

I QTEUSTBULNLURQNG WEGQZQSE 

L PIDOPLDRJRDHNJB IBNVNOI 

L IDOPLDRJRDHNJB BNVNOTI 

E 

R 

Y 
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d. (1) Another technique, if we know or can assume the method of key interruption (e.g., a skip over 
one element of the key after the occurrence of a previously designated ciphertext letter, in this case W,), 
involves writing out the modified cipher text of a single message on trial widths in order to see if any 
cyclic properties are present in the basic, uninterrupted key. We can then determine statistically when the 
correct cyclic write-out is reached by the application of a technique discussed in the preceding text." 


As an example, let us assume the following message is at hand: 


GSWWT RHZDW GLNUJ WXRWR HNQLS YXTEV 
GCVBW CWZUV IAVFG XXFNP HGPHA MIKDR 
VCTEA VCAWG JICGG CISNS IVCJB SZSRW 
VLKZR JBHCC CAYQV WJIMRL WTLRS DJXFN 
ZZIAF MQJCX 


(2) If we know the method of interruption and also the identity of the ciphertext interruptor,”” we 
would write out the appropriately modified cipher text on various widths, testing each hypothesis in 
turn, until a satisfactory I.C. is reached for an entire columnar array. For example, if we know that the 
enemy is using key words and phrases from 11 to 40 letters in length as the basic key sequence, we would 
begin by writing out the modified cipher text (on the assumption of W, as the interruptor letter) on a 
width of 11 as shown below, together with the appropriate ¢ values for the computations: 


-_ 
_ 


~ 
a 


mo 


1 2 3 5 7 8 10 
GSW.wW.TRHZD 
W.GLNUJIW.XR 
W.RHNQLSYXT 
EVGCVBW.CW 
ZUVIAVFGXXF -18 USC 798 
NPHGPHAMIKD -50 USC 3024 (1) 
RVCTEAVCAW. 86-36 
GJICGGCISNS 
IVCJBSZSRW. 
VLKZRJBHCCC 
AYQVW.JIMRLW 
-TLRSDIJIXFNZ 
ZIAFMQJICX 
@ 6 6 4 2 4 212 6 6 14 2 Ep=64 
N: 12 11 13 12 13 11 13 12 12 12 9 


(3) The row of numbers immediately beneath the write-out represents the ¢ values of the columns; 
the row beneath the ‘‘¢”’ row, labelled “‘N’’, represents the number of letters in the columns. Since there 


16 Cf, Subpar. 18e on pp. 28-31 of Military Cryptanalytics, Part 11. 
1TTf worst came to worst, we could test each of the 26 letters in turn as the ciphertext interruptor. This testing, 


coupled with the writing out of the cipher text on the various widths, would be quite laborious and time-consuming by 
manual methods; data processing machine techniques would here be very useful. 
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are 3 columns of 13 letters each, 5 columns of 12 letters each, 2 columns of 11 letters, and 1 column of 
9 letters, the expected value of ¢ random (¢,) is given by the formula 


3(13-12) +5(12-11)+2(11-10)+1(9-8) 1420 


The 61.C. is defined as the ratio of the observed value of ¢ to the expected value of ¢random, or = Now 


since the ¢ (which is the sum of all the ¢ values for the columns) is 64, our I.C. formula becomes, by 
simple algebraic transformation, 


26-64 1664 


313-12) -5(12-11) +201. 10) 4109-8) 14207)!” 


é1.C. 


(4) This I.C. of 1.17 is not satisfactory, so we continue testing successively greater widths, until the 
width of 32 is reached: 





5 10 15 20 25 30 32 
GSw.w.tTRHZDW GLNUJW.XRW.RHNQLS YX 
TEVGCVBW.CW.ZUVIAVFGXXFNPHGPHAMI 
KDRVCTEAVCAW.GJISICGGCISNSIVCJBSZS 
RW.VLKZRJIBHCCCAYQVW.JIMRLW TLRSDJ 
XFNZZIAFMQJCX 

@—-—--—- 22—-—-2—-2—~+-4—- 2 — 2 2-2 2 _ — 2 — -— 6 — — %2=30 
N: 6 5 4 4 5 4 6 & 4 56 6 4 3 4 444 4 2 4 4 4 3 4 383 44 4 4 4 
At this width, the I.C. calculation becomes 
sLC.= 26-30 780 1.89, 


7(5-4) +21(4-3) +3(3-2)+1(2:1) 412 — 


giving statistical credence to the assumption of 32 as the correct width, since we were looking for an 
1.C. in the vicinity of 1.73 for the correct case.’® Knowing the components involved, we may complete 
the plain-component sequence on the letters of the columns to effect a speedy solution. 

19. Solution when unknown cipher alphabets are employed.—a. In the first text in this series, it 
was pointed out that “in the final analysis, the solution of every cryptogram involving a form of substi- 
tution depends upon its reduction to monoalphabetic terms, if it is not originally in those terms.” !° 
In the preceding volume, it was observed that when in the course of solution of an ordinary repeating-key 
cipher the text is written out in period-lengths, ‘“‘another way of looking at the matter is to conceive of 
the text as having thus been transcribed into superimposed periods; in such a case the letters in each 


38 The reader might be interested in the I.C.’s for all the widths from 11 to 40; these are shown in the following table: 














Ww 6 w 6 Ww 6 Ww 5 W 5 WwW 6 

11 { 1.17 16 {| 1.11 21; 0.91 26 | 1.06 {| 381 { 1.08 || 36 7 1.33 

12 | 3.09 17.{| 0.95 || 22 | 1.35 |) 27 | 1.24 }} 82 | 1.89 || 37) 1. 69 

13 | 1. 06 18 | 1.03 |} 23 | 1.18 jj 28 | 0. 98 |] 33) 0.79 || 38 | 1. 28 

14) 0.91 19 | 1.02 |} 24} 1.17 || 29 | 1. 67 || 34 | 0. 68 || 39 | 0. 98 
0. 86 |] 25 | 1 


ie ta p20 - 20 |} 30 | 1.29 |) 35 | 1.14 |] 40 | 1.01 





Note the I.C. of 1.67 for the width of 29, and the I.C. of 1.69 for the width of 37. These I.C.’s are certainly satisfactory; 
however, the widths from which they were derived are incorrect, so that they represent the vagaries of the touch not of a 
Mephistophelian finger, but rather that of a Bernoullian digit when an insufficient number of trials is involved. 


19 Military Cryptanalytics, Part 1, subpar. 176. 
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column have undergone the same kind of treatment by the same elements (plain and cipher components 
of the cipher alphabet).” *° It follows that, even if the repeating key is very long, if there are many short 
cryptograms all enciphered by exactly the same key and each message begins at the same point in the 
key, the distributions applicable to the successive columns of text can be solved.” Even in aperiodic 
systems, if there is available a number of messages starting out in the same key which then diverges in 
the course of encipherment according to the nature of the cryptosystem, this solution by superimposition 
may be applicable in particular cases, so long as the key divergence is not too radical for cryptanalytic 
comfort. 

b. Let us study the following beginnings of 30 messages, passed between correspondents known to 
have used various types of aperiodic keying: 


5 10 15 5 10 15 
1¥YFWFMRIQMXXELMJ 16.GOEQBQOTLESACRB. 
2,HWWTTECTDOZFDOV 17. WTSRGXMZTVSIQLX. 
3. TPYFKSOVWIHFNCJ 18. WTEVFCIBTSPRCAT. 
4,.YPEPSNLSKZNVTJB 19. ZC VYMBVNYWQUZGU. 
5. EAQUZDVESKCIUPA . 20.ZCTTZWCTTIKHQUT. 
6. ZCGMWTNBIMKUSNL .-21.ZCCTSNESKOUBMPT. 
7, EPDOZFDOVBILVLW 22.AFESJONKTDVESKC. 
8. EPTLESACRBMPTPJ 23.ZCFFDTNPFDHODTPF. 
9. WMLSOTOZEEJZGVK .- 24 VZIEXRXRFFUNTQE. 
10.ZCFFDCFRJIWHLPODT . 25. EPSNULUSKLOHWPTRG. 
ll. HC QEDTPYILNREMV 26. YTSVWLSTLESACRB. 
lz. CLCTZIKSOEOZCTT 27. WAZXZQACHQUTLST. 
13. HC QEFDKIFQWOCLM . 28. NOFTZNLHQUTJHZA. 
14. EPTWKSUZNVVAUCS . 29. VRCWKMOLNXWSDOL. 
15. ZABMZHGOFXQIGMM 30. SPRCPFXEOJCQFWM. 


20 Military Cryptanalytics, Part II, subpar. 65a. 
21 Cf. subpar. 65), Military Cryptanalytics, Part II. 
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The presence of digraphic and polygraphic repetitions in the initial columns could mean that the messages 
start out in flush depth, and the presence of offset repetitions could be an indication of shifts in the keying 
sequence. Frequency distributions for the columns are made and are shown in Fig. 16, below, accom- 
panied by their I.C.’s: 
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c. The first two columns sre certainly monoalphabetic; after that, there is a rapid falling off in 
monoalphabeticity, with the exceptions of cols. 5, 13 and 15 which could be due to chance. We note the 
digraph ZC, which occurs 6 times in cols. 1 and 2; this could well be the equivalent of RE,, and HC, in 
cols. 1 and 2 could stand for SEy. On this basis, ZCFFD in Messages 10 and 23 could represent REFER, and 
HCQE in Messages 11 and 13 could be SEND. We then note 


235. 


0) 


AN WN 


Aa wa 


Q ™ 


5 


FD 
ER 
MW 


10 15 


TNPFDHDTPF. 


TNBIMKUSNL. 





~SEGREF 


which could represent REFERENCE and REGIMENT. We now turn our attention to the following four 


message beginnings: 
10 15° 


5 
TZNLHQUTJHZA. 


28. NOFTZ 
F R 
20.ZCTTZWCTTIKHQUT. 
RE R 
21. ZCCTSNESKOUBMPT. 
RE 
12.CLCTZIKSOEOZCTT. 
R 
If we assume that T, in col. 4 represents 0,, then in No. 28—-FOR . . . becomes INFORM( ATION), in 
No. 20 RE-OR— becomes REPORT, in No. 21 RE-O . . . becomes RECOMMEND, and in No. 12—COR-—N— 


becomes ACCORDING. 
d. The plain-cipher equivalencies from the foregoing assumptions are entered into a sequence 
reconstruction matrix, as shown below: 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 





1]/¢ N ZH 
2 L ¢ 0 

3 C FG Qo 

4 ()F (M) 

5 “se y 

6 1a N W 
71L E K N 
8 P Ss By 
9 QF o @ 

10 

11 








Conflicts are noted in lines 5 and 8, and between lines 4 and 9; however, possibility of direct symmetry is 
noted in the top four lines, which indicates that the recoveries in these lines could well be homogeneous, 
not having been affected by vagaries of the keying. Transferring values among these four lines, we will 
develop the reconstruction matrix into the following, in which the cipher components are slides of what 
is patently a keyword-mixed sequence (derived values in lower case): 


P: ABCDEFGHIJKLMNOPQRSTUVWXYZ 





1\,¢ efg mNo q t ZH 1 
2 L C efg mndQd q t zh 

3/1 Cc e FG mno Q T zh 

4 c EF g Mno q T zh i 








SECRET. 


Our work sheet will now look as illustrated in Fig. 17. which includes the values in the first four columns 
obtained by direct symmetry shown in lower case: 


5 10 15 5 10 15 
1YFWFMRIQMXXKELMJ...16.GO0OEQBQVOCFXESNH. 
h E eNenm 
2 HWWTTECTDOZFDOV.. .I1I7.WTSRGKXEMZTVSJIQLX. 
NS 0 r 
3. TPYFKSOVWIHFNCJ...18.WTEVFCIBTSPRCAT. 
n E re T 
4,.YPEPSNLSKZNVTJB...19. ZC VYMBVNYWQUZGU. 
e MMAND RE 
5. EAQUZDVESKCIUPA . 20.Z2CTTZWCTTIKHQUT 
Cc N R REPORT 
6. ZCGMWTNBIMKUSNL...21.Z2CCTSNESKOUBMPT 
REGIMENT RECOMMEND 
7 EPDOZFDOVBILVLW . 22. AFESJONKTDVESKC. 
c kR he N 
8. EP LESACRBMPTPF . 25. ZCFFDTNPFDHDTPF 
Cc PZ REFERENCE 
9. WMLSOTOZEEJZGVK . 24 VZIEXRKXKRFFUNTQE 
la E Vv D EB 
10. ZCFFDCFRJWHLPHX...25.EPSNLSKLOHWPTRG 
REFER Cc j I G 
ll. HCQEDTPYILNREMYV . 26. YTSVWLSTLESACRB 
SENDRE r M 
le. CLCOCTZIKSOEBEOZCTT - 27. WAZXZQACHQUTLST 
ACCORDING t R 
13. HC QEFDKIFQWOCLM . 28. NOFTZNLHQUTJHZA. 
SEND I E INFORMATION 
14. EPTWKSUZNVVAUCS - 29. VRCWKMOLNXWSODOL. 
Cc P Cc 
15. ZABMZHGOFXKXQIGMM...30.SPRCPFXEOJCQFWM. 
R IR E b G 


Ficure 17 


e. At this point more plain text could be assumed in the messages from the fragments already 
present; the cipher component would be recovered in its entirety, the basic key determined, and the 
cause of the key interruptions (as manifested by the apparent garbles) ascertained. Or, as another 
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approach, we might take an introspective look at the first 5 letters of matched plain and cipher of the 
following three message beginnings: 


10. ZCFFOD. 
REFER 
20.Z2CTTZ. 
REPOR. 
28. NOFTZ. 
INFOR 


We note the D.=R, and Z,=R, in position 5 of Messages 10 and 20, and observe that, if the system 
employs a ciphertext interruptor, it may be either F, or T,; but if TZ.=OR, in Messages 20 and 28 is 
causal, F, and T, are eliminated and therefore there is no ciphertext interruptor. in the cryptosystem. 
We then note the common F,.=F, between Messages 10 and 28 and the fact that in position 5 of Message 
28 Z.=R,, and we may conclude that, if a plaintext interruptor is present, it must be 0). We find this 
to be true, and when we finish the solution of the problem we find the cipher component to be our perennial 
friend, the HYDRAULIC . . . XZ sequence, and the basic key to be CALIFORNIAGOLDR(USH) . 

20. Additional remarks.—a. We have seen in the preceding paragraph a demonstration of solution 
of only one irregularly keyed system involving unknown cipher alphabets. The solution involved a set of 
very fortunate circumstances indeed, all of which were happily present awaiting rapid exploitation by 
the cheerful cryptanalyst. Modern cryptanalysis is quite often contingent upon miracles—minor miracles 
for minor systems, and healthy miracles for some of the complex systems encountered in present-day 
operations. When we come right down to it, all cryptanalysis is astonishing; it certainly is so to a lay- 
man, and it is so even to an expert—if he pauses long enough from his breaking of one system after 
another to marvel at the phenomenal luck he has had, shuddering at the thought of what would have 
happened if (i.e., if the enemy had done this instead of that, if he had used this instead of that, and 
if. ..), On the other hand, all cryptanalysis is quite commonplace: ” after all, messages have been 
encrypted with certain invariant mathematico-philosophical-procedural elements, and all the crypt- 
analyst does is to discover and exploit these elements. And, in retrospect, after a problem has been solved, 
we often shrug our shoulders and say ‘‘Well, how else would one have done it?” Many systems of the 
types treated in this volume could be virtually unsolvable, or might appear to be so, if only a small 
amount of traffic is available for study, and if little or nothing is known about the nature of the crypto- 
system. However, as happens time and again in actual operations, Fortuna smiles and the incredible 
is shorn of its prefix. 

b. Operationally, cryptodilemmas are resolved by the exploitation of contingencies which are by 
now well-known to the reader: (1) messages in the same or nearly the same keys; (2) depths and partial 
depths; (3) polygraphic repetitions; (4) cribs; (5) various kinds of cryptographic errors; (6) isologs; 
(7) matched plain and cipher; (8) isomorphs; (9) indicators. Each problem presents a very special case, 
and therefore demands its own special requirements for solution. 

c. Most of the types of aperiodic substitution discussed in this chapter are rather unsuitable for 
practical military usage. Encipherment is slow and subject to error. In some cases encipherment can be 
accomplished only by a single-letter operation. For, in interruptor systems, if the interruptor is a cipher 
letter the key is interrupted by a letter which cannot be known in advance; if the interruptor is a plain- 
text letter, while the interruptions can be indicated before encipherment is begun, the irregularities 
occasioned by the interruptions in keying cause confusion and quite materially retard the enciphering 
process. In deciphering, the rate of speed would be just as slow in either method. It is obvious that one of 
the principal disadvantages in all these methods is that if an error in transmission is made, if some letters 
are omitted, or if anything happens to the interruptor letter, the message becomes difficult or impossible 
to decipher by the ordinary cipher clerk. In spite of all these objections, plus the fact that the degree of 
cryptosecurity attainable by most of these methods is not sufficient for military purposes, these systems 
have been and are still occasionally encountered—which is what makes the cryptologic world go round. 


22 It must have been a deep thinker who first uttered the statement that ‘all problems in cryptanalysis, like mathe- 
matics, are either trivial or impossible.” 
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21. The cryptography of autokey encipherment.—a. The mechanics of autokey encipherment were 
treated briefly in the preceding volume.’ In autokey systems there are two possible sources for successive 
key letters: the cipher text or the plain text of the message itself. In either case, the initial key letter or 
key letters are supplied by prearrangement between the correspondents, or are designated by means of 
an indicator; after that, the text letters that are to serve as the key are displaced 1, 2,3 . . . intervals 
to the right, depending upon the length of the prearranged key. 

b. An example of ciphertext autokey encipherment is shown below, wherein the cipher alphabets 
are direct standard alphabets, and the single letter X is the prearranged initial key: 


Sn eee eee 
P: THIRDREGIMENTCOMMANDPOSTMOVING. 
C:QXFWZQUATUYLEGUGSSFIXLDWIWRZMS 


Figure 18a 


Instead of having a single letter serve as the initial key, a word or even a long phrase may be used, as 
in the example below wherein the word FORTUNE is used as the initial key: 


K: ee ee Oe 
Tr: DREGIMENTCOMMANDPOSTMOVING. 
C: YVZKXETITEDLOKXKSPXOXAZGHQALVHTN 


Ficurt 18b 


Sometimes only the last cipher letter resulting from the use of the prearranged key word is used as the 
key letter for enciphering the autokeyed portion of the text. Thus, in the preceding example, the plain 
text beginning GIMENT . . . would be enciphered differently as follows: 


eee ae eee 
P: THIRDREGIMENTCOMMANDPOSTMOVING 
Cc: Y¥VZKXEITOWIMZSUILUGGTWLZRKWKFNAG 


Fiaurr 18¢ 


c. In plaintext autokey encipherment the procedure is quite similar, as is shown in the following 
example wherein the prearranged initial key is the letter X: 


Ki XITHIRDREGIMENTCOMMANDPOSTMOVIN 
P: THI REGIMENTCOMMANDPOSTMOVING. 
C: QAP UVKOUQRGVQAYMNQSDGLFAJDVT 


Ficure 19a 


1 Cf. subpar. 99e on pp. 310-311 of Military Cryptanalytics, Part II. 
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If the word FORTUNE were used as the initial key, the plain text would be enciphered as follows: 
K: FORTUNEITHIRDREGIMENTCOMMANDPOS 
RDREGIMENTCOMMANDPOSTMOVING. 
KXEIZPUVQKGUUYEAWRCEFMBYXBY 

Ficure 196 


P: THI D I 
Cc: YVZ x P 


d. In the foregoing examples, direct standard alphabets were used; however, mixed alphabets, 
either interrelated or independent,? may be used just as readily. Furthermore, instead of the ordinary 
type of cipher alphabets, the cryptographic process may employ a mathematical process of addition, but 
the difference between the latter process and the ordinary one using sliding alphabets is more apparent 
than real. For example, let us consider the following numerical sequence for the 26 letters 


HYDRAULICBEFGJKMNOPQSTVWXZ 


12 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 2 24 3 0 


and let the plaintext message be the same as before. Let us assume that the cryptographic rules prescribe 
that the first plaintext letter will be self-enciphered,? and that each cipher letter from that point on is 
produced in turn by finding the sum (mod 26) of the numerical equivalents of the preceding cipher letter 
and the plaintext letter to be enciphered; in other words, a type of numerical ciphertext autokey system. 
This is shown in the diagram below, wherein P' denotes the numerical equivalents of the plain text, C' 
the sum of the key and the numerical (i.e., intermediate) plain text, and C the conversion into letters of 
the intermediate cipher text C'. 


K : 0 22 2 5 9 12 16 1 14 22 12 2 14 10 19 11 1 17 22:13:16 9 1 2 18 8 O 23 5 2 
P:THIRDREGIMENTCOMMANDPOSTMOVING. 
P': 22 1 8 4 3 4 1 13 8 16 11 17 22 9 18 16 16 5 17 3 19 18 21 22 16 18 2 8B 17 18 
C':; 22 23 5 9 12 16 1 14 22 12 23 14 10 19 11 1 17 22:13:16 9 1 22:18 8 O 2 5& 2 9 
C:TVACFMHITFVJIBPEHNTGMCHTOIZVATC 


FicureE 20a 


e. That the difference between the types of encipherment in the preceding subparagraph and the 
ordinary method of ciphertext autokey encipherment is illusory is demonstrated by the example in Fig. 
208, below: 


K: ZTVACFMHJTFVJBPEHNTGMCHTOIZVAT 

P: THIRDREGIMENTCOMMANDPOSTMOVING 

Cc: TVACFMHJTFVJIBPEHNTGMCHTOIZVATC 
Ficurr 206 


In this example, the plain and cipher components are keyword-mixed sequences based upon HYDRAULIC, 
and Z, is the index letter against which the key letters in the cipher component are set; the cryptographic 
results are identical to those obtained in Fig. 20a, above. 


jf. Since the analysis of ciphertext autokey systems is usually easier than the analysis of plaintext 
autokey systems, the former will be the first to be discussed. 

22. Solution of ciphertext autokeyed cryptograms when known cipher alphabets are employed.—a. 
First of all, it is to be noted that if the cryptanalyst knows the cipher alphabets which were employed in 
encipherment, the solution hardly presents any problem. It is only necessary to decipher the message 
beyond the key-letter or key-word portion and the initial part of the plain text enciphered by this key 
letter or key word can be filled in from the context. 


2? For instance, an autokey system might incorporate independent, random alphabets such as those illustrated in Fig. 
33 on p. 70. 
3 This, on a numerical scale, is tantamount to the effect of a key of 9. 
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(1) For example, let us consider the following beginning of an intercepted message: 
QXFWZ QUAIU YLEGU GSSFI. 


On the assumption of ciphertext autokey involving direct standard alphabets, if we write the cipher 
text as key letters, displaced one interval to the right, we obtain the following decipherment: 


K: QXFWZQUATIUYLEGUGSSF 
C: QXFWZQUATIUYLEGUGSSFI 
P: HIR 


Z S 
DREGIMENTCOMMAND 


The introductory key letter required to make Q,=T, is found to be X,. 
(2) As a second example, let us consider the following beginning of a cryptogram suspected to have 
been enciphered by ciphertext autokey with direct standard alphabets: 


BPAUV NLFJA LYMLQ NAELR. 
Assuming an introductory key of one letter, we obtain the following decipherment: 


K: Ce ee eee 
Cc: BPAUVNLFJALYMLQNAELR. 
P: OLUBSYUERLNOZFXNEHG 


Nothing. We now assume that the introductory key consisted of two letters, and we get the following 
results: 


K: BPAUVNLFJALYMLQNAE 
C: BPAUVNLFJALYMLQNAELR 
P: ZIVTQSYVCYBNECKRLN 
Still nothing. We make several more trials, and finally, on the assumption of an introductory key of 8 


letters, the following is obtained. 


K: BPAUVNLFJALY 
Cc: BPAUVNLFJALYMLQNAELR. 
P: ILLERYFIREAT 
It is clear that the introductory key is 8 letters in length. Doing what comes naturally, 
K: NUMBPAUVNLFJALY 
Cc: BPAUVNLFJALYML NAELR. 
P: ARTILLERY IREAT 


letters of the key or with the beginning of the message plain text, we obtain the complete solution: 


pee ie ee ae 
Cc: BPAUVNLFJALYMLQNAELR. 
P: BEGINARTILLERYFIREAT 


(3) In a third case, we will assume that the following is the beginning of an intercepted message: 


DITGC MGTZB PCVDQ KYSKP. 
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Again assuming direct standard alphabets, writing the cipher text as key letters displaced one interval 
to the right and deciphering, we obtain the following: 


K: DITGCMGTZBPCVDQKYSK 
Cc: DITGCMGTZBPCVDQKYSKP 
P: FLNWKUNGCONTINUOUSF 
We note the plain text “CONTINUOUSF . . .” emerging, preceded by the NG which is probably ING; 


this indicates that ciphertext autokey is involved with an initial key of 7 letters, and that the last letter 
of the initial key is used to start the autokeyed portion. After a little experimentation with the initial 
portion of the message text and the key, we recover the key word and the first word of the message, 
as follows: > 








K: MERCURYIGTZBPCVDQKYSK 
C:DITGCMGTZBPCVDQKYSKP. 
P:RECEIVINGCONTINUOUSF 


b. A mechanical method of solution for ciphertext autokeyed cryptograms when the components 
are known sequences may be of interest. The method involves the use of sliding alphabet strips aligned 
in such a manner that, as one progresses from left to right across the strips, each key letter is set opposite 
the letter k on the preceding strip: ° the plain text will appear to the left of the pertinent cipher letter on 
each strip. In other words, what we have is a mechanical method of correlating the letters of the key, 
cipher, and plain text; the method is best understood by examples. 

(1) In Fig. 21 is illustrated the arrangement of standard-alphabet strips for the first 10 letters of 
putative key, QXFWZQUAIU, for the message beginning given in subpar. a(1), above. If we assume that 
a one-letter introductory key has been used, the key letters just named were used to key the 2d through 
11th cipher letters, XFWZQUAIUY; therefore we search for these cipher letters consecutively across the 
strips and we note the letters to their immediate left. In this case the plain text HIRDREGIME is mani- 
fested and the problem is solved. 


* The I of ING gives a key of Y, which should be preceded by a T, A, L, or very few other letters. 

5 The key word and the first word of the message may be recovered by working backwards from ING,, or by assuming 
various initial digraphs for the plain text or the key; a trial of RE, for the message beginning would yield ME,, and we 
could go on from here to read this ‘‘depth of one.”’ 

6 This is under the assumption that A, is the index letter in the cryptographic equations. 
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(ILLERYFIRE) 


(OLUBS YUERL) 


(HIRDREGIMEB) 


(P): 


FiGuRE 226 


Figure: 21 


Ficuker 22a 
(2) The next example in Fig. 22¢ illustrates the strip arrangement for the first 10 letters of key, 


BPAUVNLFJA, for the message beginning given in subpar. a(2). If a one-letter introductory key has been 


used, these key letters apply to the 2d through 11th cipher letters, PAUVNLFJAL; the decipherment of 
these letters is found to their immediate left, which is OLUBSYUERL, obviously not plain text. On the 


same diagram we then search for the decipherment of the 3d through 12th letters, assuming that a 
two-letter introductory key was employed; again this yields no valid plain text. Finally, on the 8th 


trial, on the assumption that an 8-letter introductory key is involved, we obtain the plain text ILLERY 


FIRE; this is shown in Fig. 226. 
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(3) For the third and final example, there is illustrated in Fig. 23a the strip arrangement for the 
first 10 letters of assumed key, DITGCMGTZB, for the message beginning given in subpar. a(3). 


(K): (DITGCMGTZB) (ZBPCVDQKYS) 
(C): (ITGCMGTZBP) (BPCVDQKYSkK) 
ADLEKMYEXWX AZAPRMPFPNF 
BEMFLNZFYXY BABQSNQGQOG 
CFNGMOAGZYZ CBCRTORHRPH 
DGOHNPBHAZA DCDSUPSISQI 
EHPIOQCIBAB EDETVQTJITRJ 
FIQJPRDJCBC FEFUWRUKUSK 
GJRKQSEKODCD GFGVXSVLVTL 
HKSLRTFLEDE HGHWYTWMWUM 
ILTMSUGMFEF IHIXZUXNXVN 
JMUNTVHNGFG JIJYAVYOYWO 
KNVOUWIOHGH KJKZBWZ2PZXP 
LOWPVXJPIHI LKLACXAQAYQ 
MPXQWYKQJSIIJ MLMBDYBRBZR 
NQYRXZLRKJK NMNCEZCSCAS 
ORZSYAMSLKL ONODFADTDBT 
PSATZBNTMLM POPEGBEUECU 
QTBUACOUNMN QPQFHCFVFDV 
RUCVBDPVONO RQRGIDGWGEW 
SVDWCEQWPOP SRSHJEHXHFX 
TWEXDFRXQPQ TSTIKFIYIGY 
UXFYEGSYRQR UTUJLGJZJIHZ 
VYGZFHTZSRS VUVKMHKAKTIA 
WZHAGIUATST WVWLNILBLJB 
XAIBHJVBUTU XWXMOJMCMKC 
YBJCIKWCVUV YXYNPKNODNLD 
ZCKDJLXDWVW ZYZOQLOEOME 
(P):(F LNWKUNGC O) (CONTINUOU S) 
Figure 23a Figure 23b 


Nothing is seen here, so a number of additional trials is made, sliding the assumed key over successive 
10-letter segments of the cipher text, all without success. We could now assume that an introductory 
key word was used, and that the autokeyed portion began with the last letter of cipher text after the 
end of the introductory key. With this in mind, we take as hypothetical key some text after the beginning 
of the cryptogram, say the 9th through 18th letters, ZBPCVDQKYS; trying this as key for the 10th through 
19th letters, BPCVDQKYSK, we are successful on the first trial as shown in Fig. 236 with the emergence 
of the plain text CONTINUOUS.’ 

c. The foregoing mechanical method serves in helping to understand the mechanics of solution of 
ciphertext autokey encipherment involving known components. A simpler approach, however, is the 
use of the method of searching for the location of a probable word, as illustrated in the previous volume.® 


7 Had we been a little more observant, we could have noticed what appears to be a good plaintext fragment NGCO 
in the very first trial in Fig. 23a; this was a contrived lapse of observation, the better to illustrate a pedagogical point in 
Fig. 236. 

8 Cf. Subpar. 22d on pp. 41-42 of Military Cryplanalytics, Part Il. 
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(1) For example, if we were to test the message beginning given in subpar. a(2), above, for the possi- 
bility of ciphertext autokey involving direct standard alphabets and an introductory key of unknown 
length, we would construct the following diagram: 








eonvnrarir 
sx WDaAo|Ws 


Figure 24 


In this diagram, the top row contains the cipher letters, and at the left are the first five cipher letters 
(the putative key) ; the row just below the line consists of the decipherments of the cipher letters with the 
first key letter; the second row below the line consists of the decipherments with the second key letter; 
and so forth. On a diagonal under the 9th cipher letter may be seen the plaintext fragment TILLER, 
proving that the introductory key was 8 letters in length. 


(2) Taking as another example the message beginning given in subpar. a(3), above, we construct the 
following diagram: 





5 10 15 20 
DITGCMGTZBPCVDQKYS KP 
DFQDZIDQWYMZSANHVPHM 
I LYUEYLRTHUNVICQKCH 
T NJITNAGIWJICKXRFZRW 
G WGANTVJIWPXKESMEJ 
Cc KERXZNATBOIWQIN 

Figure 25 


Nothing of significance is seen, so, testing the possibility of autokeying from the last letter of a long 
introductory key, we construct the diagram shown below, in which we have arbitrarily taken as tentative 
key elements the cipher letters starting at position 11: 





5 10 15 20 
DITGCMGTZBPCVDQKYS KP 
P GOBVJDVA 
C BOIWQIN 
V VPDXPU 
D HVPHM 
Q UICUZ 

FicuRE 256 


On the very first diagonal, the plain text fragment NTINU manifests itself, showing that the single-letter 
offset keying begins at least by the 12th cipher letter, if not before (it actually begins at the 8th position, 
after a 7-letter introductory key, as can be quickly determined). 

d. The index letter was A, in the foregoing examples; if some other letter were used as the index 
letter, only a slight modification of the general procedure is necessary. Let us study the following example 
enciphered with direct standard alphabets, with Q, as the index letter: ° 


Poe eee eee 


K: X ZCYWBTQ 
P: THIR EGIMENTCOMMAN OSTMOVING. 
C: ARJK MCUQEBEQOKGQN XZCYWBTQG. 


® Note that, although the plain text and introductory keys are identical with thos2 of the example in Fig. 18a, never- 
theless the two cipher texts are not isomorphic, since the change of index letter eliminates any causal isomorphism between 


the two versions. 
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If we had only the cipher text, and assumed that it was the result of ciphertext autokey encipherment 
with direct standard alphabets and a one-letter introductory key, we would perform the following 
decipherment on the basis of A, as the index letter: 


K: ARJKXYMCUQEBEQOKGQN 
C:ARJIKXYMCUQEBEQOKGQNA. 
NPM: RSBNBOQSWOXDMYWWKXN 


The ‘“decipherment” does not yield plain text; but if we complete the plain-component sequence on the 
result of this decipherment, we will obtain the true plain text on one of the generatrices, as shown in the 
diagram below: 


OVOARMrAGHIDQAMVAWPNK MBA CHHNDW 
AOVOAAOCAGCHIDQAMOQAWPNK MH SA CHN 
PNK HBS CHNWOVO SZ ESPRUH TOBA VAW 
EBrAGCHLHCQAAVCMAQWPNK KM SBS CHNWOVOZ 
PNK HSK CHNAWAOVSOZEZrTAGHTOAAMIAW 
ZEUrAGHBQAMOQWPNK KH SEACH NWOVO 
TWOZEMIARGCHIAQDQAAOCQWPNK KM SA CHUWO 
AH VOARCAGHIOQDAAVIVIAWPNKH HSA CHNH 
SCHNWAOVOAZBEMTAGHIHAQBAAVQWDPNK MS 
2EBUrRGCHIDQAMOQWPNK MSS CHNAOVO 


23. Principles of solution by frequency analysis.—a. It is apparent that repetitions in ciphertext 
autokey systems will not be nearly as plentiful in the cipher text as they are in the plain text, because 
in these systems before a repetition can appear two things must happen simultaneously. First, of course, 
the plaintext sequence must be repeated, and second, one or more ciphertext letters (depending upon 
the length of the introductory key) immediately before the second appearance of the plaintext sequence 
must be identical with one or more ciphertext letters immediately before the first appearance of the 
plaintext sequence. This can happen only as the result of chance. In the following example the intro- 
ductory key is the single letter X, and the components are direct standard alphabets employed in the 
usual Vigenére manner: 


K: XIC KK BTMDHNVHLY. -KDKSJMDHNVHLY 
P: FIRSTREGIMENT. -THIRDREGIMENT 
Cc: CKBTMDHNVHLYR. -KDKSJMDHNVHLYR 
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The repeated plaintext word, REGIMENT, has only 8 letters but the repeated ciphertext sequence 
contains 9, of which only the last 8 letters actually represent the plaintext repetition. In order that the 
word REGIMENT be enciphered by DHNVHLYR the second time this word appeared in the text, it was 
necessary that the key letter for its first plaintext letter, R, be M both times; no other key letter will pro- 
duce the same cipher sequence for the word REGIMENT in this case. Each different key letter for en- 
ciphering the first letter of REGIMENT will produce a different encipherment for the word, so that the 
chance for a repetition in this case is 1 in 26. This is the principal cause for the reduction in repetitions 
in this system. If an introductory key of two letters were used, it would be necessary that the two cipher 
letters immediately before the second appearance of the repeated word REGIMENT be identical with the 
two cipher letters immediately before the first appearance of the word; therefore the chance for a repeti- 
tion in this case is 1 in 267. In general, then, an n-letter repetition in the cipher text, represents an (n-k) 
letter repetition in the plain text, where n is the length of the ciphertext repetition and & is the length 
of the introductory key. 

b. There is a second phenomenon of interest in connection with ciphertext autokey systems. Let 
the letter opposite which the key letter is placed (when using sliding components for encipherment) 
be termed, for convenience in reference, the ‘‘base letter.’’? Normally the base letter is the initial letter 
of the plain component, but it has been pointed out in the preceding volume that this is only a conven- 
tion. Now when the introductory key is a single letter, if the base letter occurs as a plaintext letter its 
cipher equivalent is identical with the immediately preceding cipher letter; that is, there is produced a 
double letter in the cipher text, no matter what the cipher component is and no matter what the key 
letter happens to be for that encipherment. For example, using the HYDRAULIC . . . XZ sequence for 
both primary components, with H (the initial letter of the plain component) as the base letter, and using 
the introductory key letter X, the following encipherment is produced: 


K: XJUNFFTTVKUHHMBN 
P: TIFTHEHYPOTHESIS. 
C: UNFFTTVKUHHMBNE 


Note the doublets FF, TT, and HH. Each time such a doublet occurs it means that the second letter 
represents H,, which is the base letter in this case (the initial letter of the plain component). Now if the 
base letter happens to be a high-frequency letter in normal plain text, for example the letter E or T, 
then the cipher text will show a large number of doublets; if it happens to be a low-frequency letter 
then the cipher text will show very few doublets. In fact, the number of doublets will be directly pro- 
portional to the frequency of the base letter in normal plain text. Thus, if the cryptogram contains 
1,000 letters there should be about 72 occurrences of doublets if the base letter is A, since in 1,000 letters 
of plain text there should be about 72 A’s. Conversely, if a cryptogram of 1,000 letters shows about 72 
doublets, the base letter is likely to be A; if it shows about 90, it is likely to be T, and so on. Further- 
more, when a clue to the identity of the base letter has been obtained in this manner, it is possible 
immediately to insert the corresponding plaintext letter throughout the text of the message. The dis- 
tribution of this letter may not only serve as a check (if no inconsistencies develop) but may also lead 
to the assumption of values for other cipher letters. 

c. When the introductory key is two letters, then this same phenomenon will produce groups of 
the formula ABA, where A and B may be any letters, but the first and third must be identical. The oc- 
currence of patterns of this type in this case indicates the encipherment of the base letter. 

d. The phenomenon noted above can be used to considerable advantage in the solution of ciphertext 
autokey cryptograms. For instance, if it is known that the ordinary Vigenére method of encipherment 
(0x2=61n3 0pn=6en) is used, then the initial letter of the plain component is the base letter. If, further, 
it is known that the plain component is the normal A-Z sequence, then the base letter is A and a word 
such as BATTALION will be enciphered by a group having the pattern AABCCDEFG. If the plain component 
is a mixed sequence and happens to start with the letter E, then a word such as ENEMY would be enciphered 
by a sequence having the pattern AABBCD.’° Sequences such as these are, of course, idiomorphic and if 
words yielding such idiomorphisms are frequent in the text there will be produced in the latter several 


10 Six letters are shown because the idiomorphism in this case extends over that many letters. 
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or many cases of isomorphism. When these are analyzed by the principles of indirect symmetry of posi- 
tion, a quick solution may follow. 

e. A final principle underlying the solution of ciphertext autokeyed cryptograms remains to be 
discussed ; it concerns the nature of the frequency distribution required for the analysis of such crypto- 
grams. Consider the message beginning illustrated in Fig. 18¢ in subpar. 215. It happens that the letter 
W. occurs three times in this short message beginning and, because of the nature of the ciphertext auto- 
keying method, this letter must also appear three times in the key. Now it is obvious that all plaintext 
letters enciphered by key letter W, will be in the same cipher alphabet; in other words, if the key text is 
cipher text offset one letter to the right of the cipher text, then every cipher letter which immediately follows a 
W, in the eryptogram will belong to the same cipher alphabet, and this alphabet may be designated conveniently 
as the W cipher alphabet. Now if there were sufficient text, so that there were, say, 30 to 40 W,’s in it, 
then a frequency distribution of the letters immediately following the W,’s will exhibit monoalphabeticity. 
What has been said of the letters following the W,’s applies equally well to the letters following all the 
other letters of the cipher text, the A,’s, B.’s, C,’s, and so on. In short, if 26 distributions are made, one 
for each letter of the alphabet, showing the cipher letter immediately succeeding each different letter 
of the cipher text, the text of the cryptograms can be allocated into 26 uniliteral, monoalphabetic fre- 
quency distributions which can be solved by frequency analysis, provided that there are sufficient data 
for this purpose. 

(1) The foregoing principle has been described as pertaining to the case when the introductory key is a 
single letter; that is, when the key text is offset or displaced but one interval to the right of the cipher 
text. But it applies equally to cases wherein the key text is offset more than one interval, provided that the 
frequency distributions are based upon the proper interval, as determined by the displacement due to the 
length of the introductory key. For instance, suppose the introductory key consists of two letters, as in 
the following example. 


oer 
= px 
aris 
mos 
Hw 
n> x 
Q wy 


The key text in this case is offset two intervals to the right of the cipher text; therefore if we made 
frequency distributions by taking the cipher letters one interval to the right of a given cipher letter 
(each time that letter occurs), these distributions will not be monoalphabetic because some letter not 
related at all to the given cipher letter is the key letter for enciphering the letter one interval to the right 
of the letter. For example, note the three R,’s in the foregoing illustration. The first R. is followed by 
H,, representing the encipherment of L, by Mx; the second R, is followed by X., representing the encipher- 
ment of F, by Q,; the third R, is followed by M,, representing the encipherment of A, by Mx. The three 
cipher letters H, X, and M are here entirely unrelated and do not belong to the same cipher alphabet 
because they represent encipherments by three different key letters. On the other hand, the cipher 
letters two intervals to the right of the R,’s, viz., F, 0, and V, are in the same cipher alphabet because 
these cipher letters are the results of enciphering plaintext letters I, 0, and T, respectively, by the same 
key letter, R. It is obvious, then, that when the introductory key consists of two letters and the key 
text is displaced two intervals to the right of the cipher text, the proper frequency distributions for 
monoalphabeticity will be based upon the letter at the second interval to the right of each cipher letter. 
Likewise, if the introductory key consists of three letters and the key text is displaced three intervals to 
the right of the cipher text, the distributions must be based upon the third interval, and so on, in each 
case the interval used corresponding to the amount of displacement between key text and cipher text. 

(2) Conversely, in solving a problem of this type, when the length of the introductory key and 
therefore the amount of displacement are not known, the appearance of the frequency distributions 
based upon various intervals after each different cipher letter will disclose this unknown factor, since 
only one set of distributions will exhibit monoalphabeticity and the interval corresponding to that set 
will be the correct interval. : 





24. Example of solution by frequency analysis.—a. Jt will be assumed that previous studies have 
disclosed that the enemy is using ciphertext autokey systems; it will be further assumed that these 


studies have also disclosed that (1) the introductory key is usually a single letter, (2) the usual Vigenére 


method of employing sliding primary components is used, and (3) the plain component is usually the 


norma] A-Z sequence, the cipher component a mixed sequence which changes daily. The following 


cryptograms, all of the same date, have been intercepted: 


Message No. 1 


IJXWX EECDA CNQET UKNMV DIWPP QZS XD 
HIFEL NNJ JI DIVEY GTCZM EHHLM RVCUR 


KSET TDIQK KMLTU RQGGN KMKIX 


GTAR JJQQY CARPH MGLDY FYTCD 
JXWKA OKNTB TZSJ0Q YSCDI DGETX G 


S 
F 


om 


H 
am 
Oo 


Message No. 2 
GRVRM ZWKXG WPCKK RMXAN JCCXU RTNJU 


AKOBL NLMWK YYZJIU CSUHF FHIJA QBMLT 


PURRS UEQEV ZEYGC FFNFI BWNYS TCETP 
DGTTZ RRQHQ AQOOXD BUYNK LBWCD GGK 


Message No. 3 
RWKAO LTCJM ZDKVU JCDDY BZELM MWTQO 


CHOLM WVGRK IBRXD LAQYU KIROZ 


Message No. 4 


> 
ow 
| 
~ WY 
Eo 


on 
2 Pp 
As 
i) 
on 


oF 
or 
Be 
Be 
zWN 


N 

evo 
tM 
OHD 
WAN 


oc OH 
sao 
NH << 
HAM 
ok 


= aN 
a0 
Hoes 
Dm x 
“xO 


Message No. 5 


NOx 
ag x 
Bf 
Oo 
Ee 


oO 
5H 
i) 
ma 
= = 


> 
on 
Coe 
IN 
AD 


AD 
HD 
o> 
NH 
BH 


Be 
> 
> 
N= 
== 


ioc 
> m% 
NH 
HN 
oO kk 


LMWKY PPDQZ GBOIW PSFAJ UQZHZ MTFHZ 
MLACZ ROVDI WPVIB OBCCXK NNDGI ESJVOC 


KBJHQ MUZEL YOOVU JWKIE IBBOZ AJTIEF 


FORSA JLNQM BQ 


Message No. 6 
TBJPA ARYYP VHIDI TUXNJ MXGSS BDAQY 


MMTTF UUNMG QPUXM OVUYE CECZM MWOHC 


FOBHV NKAZC KM 


Message No. 7 


TBJPA QAAZT RXALX FKKME IAABD SFTQT 


CJ JGJ OVMRG LVWTT JUAWL XUKTX GGBOX 


MXDID SPBSF LYZKC F 
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b. A distribution table is now compiled, the results of which are shown in Fig. 26, below; in originally 
making the distribution, tallies had been recorded in the appropriate cell in the pertinent horizontal 
line of the table to indicate the cipher letter which immediately followed each occurrence of the letter 
to which that line applies. Obviously, the best method of compiling the data is to treat the text bi- 
literally, taking the first and second letters, the second and third letters, and so on, distributing the 
digraphs as tallies in a digraphic distribution. 













ABCDEFGHIJKLMNOPQRSTUVWXYZ N @ Ic. 
A 29 64 2.05 
B 24 26 1.22 
C 35 «662 1.35 
D 30 120 3.59 
E 28 52 1.79 
F 21 28 1.73 
G 3 29 32 1.02 
H 1 23 22 1.13 
zc 3 33. 70 1.72 
J 2 32 56 1.47 
K 2 31 58 1.62 
L 2 22 44 2.48 
M 14 3 37 70 1.37 
N 2 1 43122 1 21 28 1.73 
0 2 212 13 1 2 3 28 48 1.66 
P 19 18 1.37 
Q 54 26 38 1.52 
R 1 25 18 0.78 
S i 22 36 2.03 
T 6 41 110 1.74 
U 3 30 44 1.31 
V 1 20 22 1.51 
W 1 22 44 2.48 
x 3 28 50 1.72 
Y 2 22 16 0.90 
Zz i 27 42 1.56 


705 1218 42.85 


Figure 26 


c. The individual frequency distributions give every appearance of being monoalphabetic, which 
confirms the assumption that the enemy is using ciphertext autokey with a single-letter introductory 
42.85 

26 
we could calculate the digraphic I.C. of the matrix by considering the sum (1218) of the ¢ values of 
Fig. 26 as the observed value of ¢ and substituting in the formula b= NN 705 xTOR 
again substantiating the same assumption.” (This discrepancy between the two figures lies in the 
round-off errors introduced in obtaining an average I.C.) 





key. The average I.C. of the rows of the matrix is = 1.65, which is fine; or, as a better approach, 


11 The arithmetic mean here suffices because the values of N involved are fairly close to one another; since, as has 
been previously stated, in ciphertext autokey systems the cipher letters are equiprobable (the over-all I.C. of the cipher 
text in this example is 1.005), a weighted mean is unnecessary. 

12 Ciphertext autokey systems may therefore be identified statistically from the appropriate digraphic distribution 
(i.e., on the assumption of the correct length of the introductory key) by the fact that the digraphic I.C. will reflect the 
monographic 1.C. of the language. 
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d. The total number of letters of text is 712, comprising 705 digraphs. If the base letter is A, then 

there should be approximately 7057.4%=52 cases of doubled letters in the text. There are actually 

. 63 doublets, which checks very well with the expectancy. The letter A is substituted throughout the 
text for the second letter of each doublet. 


e. The following sequence is noted at the beginning of Message No. 5: 
GISUH WZHST TZO0TD DHQOOV NBTJG XCTBS 
A A A 


Assume that the sequence DDHOOVNBT represents the word BATTALION, in which case we will have the 
following key-cipher-plain relationships: 


Oo 
WOH 
rPuUo 
ys Llo 
HOT 
roo 
r< oO 
Ha2<4 
ow =a 
2Hw 


If this assumption is correct, the frequency of H, in the D alphabet should be high, since H.=T,; the H, 
has only two occurrences. Likewise, the frequency of 0, (=T,) in the H alphabet should be high; it is 
also only two. The frequency of V, in the 0 alphabet should be medium or low, since it would equal L,; 
it is five, which is too high. The rest of the letters of the assumed word are similarly checked against the 
appropriate frequency distributions, with the result that, on the whole, the assumption that the 
DDHOOVNBT sequence represents BATTALION does not appear to be warranted. Similar attempts are 
made at other points in the text, with the same or other probable words. Some of these attempts may 
have to be carried to the point where the placement of values in the tentative cipher component leads 
to serious inconsistencies. Finally, attention is fixed upon the following sequence in the second line 
of Message No. 6: 

MMTTF UUNMG 
A A A 
If we assume that this skeleton represents the word AVAILABLE, the following fragment of key, cipher, 
and plain should be true: 


K: MMTTFUUNMG 
C: MTTFUUNMG 
P: AVAILABLE 


Reference is now made to the appropriate frequency distributions to see how well the actual individual 
frequencies correspond to the expected ones; these data are tabulated in the diagram below: 














Assumed Frequency 
Alphabet Approximation 
6. Oy Expected Actual 
M T Vv Low 2 Fair 
T F I High 2 Fair 
F U L Medium 1 Good 
U N B Low 1 Good 
N M L Medium 2 Fair 
M G E High 2 Poor 
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This assumption of AVAILABLE cannot be discarded just yet. Let the values derivable from the assump- 
tion be inserted in their proper places in a cipher component, and, using the latter in conjunction with a 
normal A~Z sequence as the plain component, let an attempt be made to find corroboration for these 
values. The following placements may be made: ¥ 


P-ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Cc: M FG UN T 


The letter M. appears twice in the cipher sequence and when this partially reconstructed cipher 
component is tested it is found that the value L,(N,) =M- is corroborated. Having the letters M, F, G, U, N, 
and T tentatively placed in the cipher component, it is possible to insert certain plaintext values in the 
text. For example, in the M alphabet, F.=D,, G.=E,, Ue-=O p, Ne=Pp, and T.=Vp. In the F alphabet, 
G.e=By, Ue=Ly, Ne=Mp, Te=Sp, and M.=X,. The other letters yield additional values in the appropriate 
alphabets. The plaintext values thus obtainable are inserted in the cipher text. No inconsistencies 
appear and, moreover, certain good digraphs are brought to light. For instance, note what is mani- 
fested at the end of the third line of Message No. 5: 


K: UQZH ZMTFH 
Cc: UQZHZ MTFHZ 
P: ViI 


Now if the letter H can be placed in the cipher component, several values might be added to this partial 
decipherment. We note that F and G are sequent in the cipher component; now let us suppose that H 
follows G therein, and we obtain the following: 


K: UQZH ZMTFH 
Cc: UQZHZ MTFHZ 
PR; vic 


Suppose the VIC is the beginning of VICINITY. This assumption permits the placement of A, C, L, and 
Z in the cipher component, as follows: 


P»-ABCDEFGHIJKLMNOPQRSTUVWXYZ 
C; MA FGH L ZUN T C 


These additional values check in very nicely and presently the entire cipher component is reconstructed. 
It is found to be as follows: 


GHIJKLMNOPQRSTUVWXYZ 
JKLQSVXZUNDERWOTYPTIC 


The key phrase is clearly based upon UNDERWOOD TYPEWRITER COMPANY. All the messages may now 
be deciphered with ease. The following gives a letter-for-letter decipherment of the first three groups 
of each message: 


K: KJI J XW XEECD ACNQE 
Message No.1 C: TJ XWX EECDA CNQET. 
P: RIGHT FAIRL YQUIE 
K: EIGRVR MZWKX GWPCK 
Message No.2 C: GRVRM ZWKXG WPCKK. 
P: NOTHI NGOFS PECIA 


13 Note that, had we not known (or assumed) the plain-component sequence, we would first have entered these 
values in a 2626 square rather than in a single strip for the cipher component, and then we would exploit any mani- 
festations of direct or indirect symmetry present. 

14 The introductory keys for these messages are presumed to have been specified by prearrangement, or indicated 
by the message number, file time, or some other element of the message externals. 
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Message No. 3 


Message No. 4 


Message No. 5 


Message No. 6 


Message No. 7 


on Sane eee oe ee re ee eee oe 
raj Arlo 2 © |b1 Q Pe |o > A 
DCW LTwWAa CHR Cus WADW 
AoW WaOW BRMNH Pon OR Ss 
AVs HvVUH Aan DvVA GQKer 
Aru Hr ey DArC OV AOPY, 
HOYT PPP OBIT HMB Oro 
NrPo ADP CNA A2AHr ayer 
rPrPePPr KD NON YUNA WO 
ENPYP PKK THE CAN THQ 
HAN Wee PHN BHR QRS 
aA Of VT PHA AAS AZ2NE 
a-xerM CHS YUNA HAW COON 
UP xs FAHE DTON APA AXY 
Tere NOH DMHO HOP AH 
Fs TC HHO NOH WANO Vacs 


f. In the foregoing example the plain component was the normal sequence, so that with the Vigenére 
method of encipherment the base letter is A. If the plain component is a mixed sequence, the base letter 
may no longer be A, but in accordance with the principle set forth in subpar. 236, the frequency of 
doublets in the cipher text will correspond with the frequency of the base letter as a letter of normal plain 
text... If a good clue is afforded by the frequency of doublets in the cipher text, the insertion of the 
corresponding base letter in the plain text will lead to further clues. The solution from there on can be 
handled along the lines indicated above. 

25. Solution by means of isomorphs.—a. It was stated in subpar. 23d that in ciphertext autokey 
systems the production of isomorphs is a frequent phenomenon and that analysis of these isomorphs 
may yield a quick solution. An example of this sort will now be studied, using as an illustration the 
following three messages which are suspected of being in a ciphertext autokey system: 


Message No. 1 
USYPW TRXDI MLEXR KVDBD DQGSU NSFBO 
BEKVB MAMMO TXXBW ENAXM QLZIX DIXGZ 
PMYUC NEVVJ LKZEK URCNI FQFNN YGSIJ 
TCVNI XDDQQ EKKLR VRFRF XROCS SJTBV 
EFAAG ZRLFD NDSCD MPBBV DEWRR NQICH 
ATNNB OUPIT JLXTC VAOVE YJJLK DMLEG 
NXQWH UVEVY PLQGW UPVKU BMMLB OAEOT 
TNKKU XLODL WTHCZR 

Message No, 2 
BIIBF GRXLG HOUZO LLZNA MHCTY SCAAT 
XRSCT KVBWK OTGUQ QFJO0C YYBVK IXDMT 
KTTCF KVKRO BOEPL QIGNR IQOVJI YKIPH 
JOEYM RPEEW HOTJO CRIIX OZETZ NK 

Message No. 3 
HALOZ JRRVM MHCVB YUHAO EOVAC QVVJL 
KZEKU RFRFX YBHAL ZOFHM RSJYL APGRS 
XAGXD MCUNX XLX¥GZ JPWUI FDBBY PVFZN 
BJINNB ITMLJ OOSEA ATKPB Y 


8 Tf the plain and cipher components had been identical sequences, this fact together with the identity of the base 
letter could have been determined from the digraphic distribution: one of the rows of the distribution (the row correspond- 
ing to the base letter) would reflect an approximation of the normal frequency distribution, i.e., peaks for the letters 
AEINORST, and blanks or near-blanks for JKQXZ. Furthermore, the reconstruction matrix would have displayed symmetry 
about the main diagonal (from upper left to lower right) ; see in this connection subpar. 33e in the next chapter. 
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b. Frequency distributions are made, based upon the second letters of pairs, as in the preceding 
676(500) _ 
451X450 | 
1.67, confirming ciphertext autokey with a single-letter introductory key. Nevertheless, the data in 
each distribution are relatively scanty and it would appear that the solution is going to be a rather 
difficult matter. 


example. These distributions are shown in the table in Fig. 27, below. The digraphic I.C. is 


2d letter 


ABCDEFGHIJKLMNOPQRSTUVWXKYZ N_ ¢ 


Ist letter 


15 10 
14 18 


451 500 





NSM BACHNDAOVAOAROTAGHIADAMVAD PS 





Figure 27 


c. Before becoming discouraged too quickly, however, we make a search throughout the text to see if 
any isomorphs are present. Fortunately, there appear to be several of them. Note the following: 


(l)...DBDDQGSUNSFBOBEK. 
Message No.1 (2) ...NEVVJILKZEKURCNIF. 
(3) ...TNKKUXLODLWTHCZRI 
Message No.2 (4) ...CRIIXOZETZN K) 
Message No.3 (5) ...CQVVJLKZEKURFRFX. 


First, it is necessary to delimit the length of the isomorphs. Isomorph (2) shows that the isomorphism 
begins with the doubled letters; for there is an E before VV in that case and also an E within the isomorph. 
If the phenomenon included the E, then the letter immediately before the DD in the case of isomorph (1) 
would have to be an N, to match its homolog, E, in isomorph (2), which it is not. Corroborating data are 
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given by isomorphs (3), (4), and (5) in this respect. Hence, we may take it as established that the iso- 
-morphism begins with the doubled letters. As for the end of the isomorphism, the fact that isomorphs 
(2) and (5) consist of the same set of 10 letters seems to indicate that this number defines the length of 
the isomorphism. The fact that Message No. 2 ends 2 letters after the last tie-in letter, Z, corroborates 
this assumption. It is at least certain that the isomorphism does not extend beyond 11 letters because the 
recurrence of R in isomorph (5) is not matched by the recurrence of R in isomorph (2), nor by the recur- 
rence of Tin isomorph (3). Hence it may be assumed that the isomorphic sequence is probably 10 letters 
in length, possibly 11. But to be on safe ground it is best to proceed on the 10-letter basis. 
d. By applying the principles of indirect symmetry to the superimposed isomorphs, partial chains 
may be constructed, as shown below: 


(1-2) DV QJ GL SK FUZ NE BR 
(1-3) NDK QUO GX SL FW BT 
(1-4) DI Qx GO SZ UE FNT BK 
(2-3) VK LX JUW 20 ED RT 
(2-4) VI JX LO RKZET UN 
(3-4) DT KI UXOE LZ WN 

These partial chains may be amalgamated into the following sequence: 
LODJXBSUN.GW.Q...FVI.RKZET 


Noting the J K at an interval of —7, and also W X Z at the same interval, we conclude that a keyword- 
mixed sequence is involved, and we derive the original sequence as 


WX¥Z..DR.ULI.BEFGJIK.NO.QSTY, 


whereupon we recognize our perennial friend HYDRAULIC and fill in the missing six letters. 

e. We now have the cipher component, and the plain component remains to be reconstructed. The 
simplest and most foolproof solution ordinarily is a reduction to monoalphabetic terms, using the re- 
covered cipher component and the known offset of the cipher text against itself as key.'* However, the 
probable word method, if the probable words are at all probable, may be used to good advantage. A 
good crib to assume for the 10-letter repetition found in Message Nos. 1 and 3 is ARTILLERY (especially 


since the doublet rate of the distribution in Fig. 27 is 3 = i 


A, to represent the doublet in the repetition). This single assumption is sufficient to place 7 letters in 
the plain component, thus: 


=7.3%, which is just right for a base letter of 


K: VVJILKZEKUR 
Cc: VVIJILKZEKUR 
P: ARTILLERY 
Bete ee Te ee a ot BG we ed Re UY de oe ae 


These few letters (few, but how beautifully spaced!) are sufficient to suggest that the plain component 
is in all probability the normal sequence. A few moments’ testing proves this to be true. The two compo- 
nents are therefore: 


P; ABCDEFGHIJK LMNO PQRSTU WXYZ 
C:HYDRAULICBEFGJKMNOPQS VWXZ 
16 Note that if the LODJX . . . sequence in subpar. d, above, had not been of systematic construction to enable us 


to analyze its derivation and thus fill in the missing 6 letters, we still could have converted most of the cipher text to 
monoalphabetic terms, solved the text, and recovered both components. 


57 —SECRET— 





“SECRET 


Jf. With the two components at hand, the decipherment of the message is a low-order triviality. 
Since a single-letter introductory key is known to have been used,” we decipher the first five groups of 
Message No. 1 as follows: 


K: ?7US YP WTRXD IMLEX RKVDB DDQGS 
Cc: USYPW TRXDI MLEXR KVDBD DQGSU. 
P: ?PHRF YIVEF IREOF LIGHT ARTIL 


The mangled beginning is the result either of garbles, or of specialized keying procedure wherein the 
last letter of an introductory key was used as the introductory key letter for enciphering the subsequent 
autokeyed portion of the text (see Fig. 18¢ in subpar. 215). If we assume that the IVE before the word 
FIRE is the ending of the first word of the plain text, and that this word is INTENSIVE, the introductory 
key word is found to be WICKER. Thus: 


K: WICKERITRXDIMLEXRKVDBDDQGS 
Cc: USYPWTRXDIMLEXRKVDBDDQGSU.. 
P: INTENSIVEFIREOFLIGHTARTIL 


The beginnings of the other two messages are recoverable in the same way and are found to be as follows: 


K: PROMISE|IRXLGHOUZ 
C: BIIBFGRXLGHOUZO. 
P:REQUESTVIGOROUS 
K: CHARGEDIRRVMMHCV 
Cc: HALOZJIRRVMMHCVB 
P: SECONDBATTALION 


g. The example solved in the foregoing subparagraphs offers an important lesson to the student, 
insofar as it teaches him that he should not immediately feel discouraged when confronted with a problem 
presenting only a small quantity of text and therefore affording what seems at first glance to be an insufficient 
quantity of data for solution. For in this example, while it is true that there are insufficient data for analysis 
by simple principles of frequency, it turned out that solution was achieved without any recourse to the 
principles of frequency of occurrence. Here, then, is one of those interesting cases of substitution ciphers of 
rather complex construction which are solvable without any study whatsoever of frequency distributions. 
Indeed, it will be found to be true that in more than a few instances the solution of quite complicated 
cipher systems may be accomplished not by the application of the principles of frequency, but by re- 
course to inductive and deductive reasoning based upon other considerations, even though the latter 
may often appear to be very tenuous and to rest upon quite flimsy supports. 

26. Solution of isologs involving the same pair of unknown primary components.—a. Two messages 
containing identical plain text encrypted in a ciphertext autokey system with two different single-letter 
introductory keys may be solved in a manner identical to that described in the last paragraph, since what 
we really have is a pair of long isomorphs one letter shorter than the length of the messages. Even if the 
introductory keys are words of different lengths and compositions, if the key usage is similar to that 
illustrated in Fig. 18¢ in subpar. 216 the message can be solved very rapidly by reconstructing the primary 
components, since the cryptographic texts of such messages will be isomorphic after the initial keyword 
portions. 


17 We know this from (a) statistical evidence of the digraphic distribution at an offset of 1, (b) the indications of the 
correct plain component emerging from a tentative decipherment of the 10-letter repetition, and (c) the unlikelihood that 
with three rather short messages a long ciphertext repetition would have manifested itself if the offset were more than 
1 letter. We knew that the three messages were autokeyed at the same offset, otherwise the isomorphs would have not 
appeared among all three messages. 
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(1) Note the two following superimposed messages, in which isomorphism between the two crypto- 
grams is both obvious and consistent after their 6th letters: 


Msg “A”: TSBJS KBNLO CFHAZ LWJAM BNFNS 
Msg “B”’: BK KMJ XYCXB HRPVO XMUVI YCRCG 
Msg “A”: MVJRE HFPRX CPCRR EHFMU HRAXC 
Msg “B”’: TIKUTD PRETN HEHTT DPRIW PTVNH 
Msg “A”: NF DUB ATFQR 
Msg “B”: CRS WY VJIRFT 
Starting with any pair of superimposed letters (after the 6th pair), the following chains are derived: 


12 3 4 5 6 7 8 9 10 1 12 13 14 
(1) ZOBY . 
(2) LE NCHPEDSG 
(3) Q@FRTJUWMI 
(4)AVK.. 


The foregoing fragments either are part of two 13-letter chains, or they are parts of a complete 26-letter 
sequence. If the former is the case, then the two 13-letter chains must be (ZO BYQFRTJU WMT) and 
(LXNCHPEDSGAVK); and, a few moments later, noting phenomena associated with keyword- 
mixed sequences in the two chains, we superimpose them in the diagram 


ZOBYQFRTJUWMI 

HPEDSGAVKLXNC 

YQFRTJUWMIZOB 
from which we speedily obtain the HYDRAULIC . . . XZ sequence.’® 


(2) Only the cipher component has been recovered thus far. If we assume that the plain component 
is the same as the cipher, the initial key words and the message plain texts are at once deciphered; it 
will be found that the initial key word for Message ‘‘A” is PENCE, and that for Message ‘‘B” is LATERAL.” 
If the plain component had not been guessed in this case, we could have “deciphered” the message text 
using an arbitrary plain component (say, the A-Z sequence), resulting in a conversion of the complex 
cipher text into monoalphabetic terms which can then speedily be solved. 

(3) The foregoing solution affords a clue to the solution of cases in which the texts of two or more 
messages are not completely identical but are in part identical because they happen to have similar 
beginnings or endings, or contain nearly similar information or instructions. The progress in such cases 
is not so rapid as in the case of messages with wholly identical texts because much care must be exercised 
in blocking out the isomorphic sequences upon which the reconstruction of the primary components 
will be based. 

b. In the preceding example the autokeyed portions of the texts started with the last letters of the intro- 
ductory keys. If full autokeying (i.e., the method shown in Fig. 185), had been employed the solution 
would hardly be more difficult. 


18 See subpar. 447 on pp. 89-90 of Military Cryplanalytics, Part IT. 

18 If the four fragments (1), (2), (3), and (4) had been parts of a complete 26-letter sequence, there would have been 
only 6 ways to permute them, viz., 1-2-3-4, 1-2-4-3, 1-3-2-4, 1-3-4-2, 1-4-2~3, and 1-4~3-2; therefore the problem 
would still be solvable without too much effort, even if the cipher component has been a random sequence. 

20 The reason that the cryptographic texts are isomorphic after the initial keyword portions is, of course, that since 
the text beyond the key word is enciphered autokey fashion by the preceding cipher letter, the letters before the last 
letter of the key have no effect upon the encipherment at all. Hence two messages having identical plain text cannot be 
other than isomorphic after the initial keyword portions. 
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(1) In order to illustrate such a case, let the same plain texts used in the preceding example be en- 
ciphered by introductory key words of the same lengths but different compositions: PENCE and LATER. 


Thus: 
Message ‘‘A”’ 
K: PENCE|TSBJS MMNRU LPUIH JBTXF INNRM 
P: REQUE STINF ORMAT IONOF SITUA TIONI 
Cc: TSBJS MMNRU LPUIH JBTXF INNRM DWIQV 
K: DWIQV PCKAO DPAZO BCMRI AFNWO GLIHT 
P: NFIFT EENTH INFAN TRYSE CTORA TONCE 
Cc: PCKAO DPAZO BCMRI AFNWO GLIHT IWWCU 
Message “B” 
K: LATER| BK KMJ RBTUX SGEBQ YRHHA TETUC 
P: REQUE STINF ORMAT IONOF SITUA TIONI 
Cc: BKKMJ RBTUX SGEBQ YRHHA TETUC NOGTM 
K: NOGTM LDQLE NGBYE WDSUH PUTZE HHGODK 
P: NFIFT BENTH INFAN TRYSE CTORA TONCE 
C: LDQLE NGBYE WDSUH PUTZE HHGDK TODEX 
(2) Now let the cipher texts be superimposed and isomorphisms be sought. They are shown under- 
lined below: 
MsgA:TSBJS MMNRU LPUIH JBTXF INNRM DWIQV 
MsgB:BKKMJ RBTUX SGEBQ YRHHA TETUC NOGTM 
MsgA: PCKAQ DPAZO BCMRI AFNWOQ GLIHT IWWCU 
MsgB:LDQLE NGBYE WDSUH PUTZE HHGDK TODEX 


It will be noted that the intervals between identical vertical pairs show a constant factor of 5, indicating 
that the messages have been enciphered with 5-letter introductory key words. 

(3) The vertical pairs beyond the first five letters of the messages are now distributed in a recon- 
struction matrix according to their position based upon this interval of 5, similar to the treatment of 
vertical pairs in periodic-cipher isologs arising from the use of repeating keys of the same lengths.” 
This is shown below: 


PABCDEFGHIJKLMNOPQRSTUVWXYZ 








From the values in this matrix the original cipher component, the HYDRAULIC . . . XZ sequence, may 
quickly be recovered, because the @ line may be included in the chaining. 


21 Cf. subpar. 60f, Military Cryptanalytics, Part IJ. 
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28. Further remarks on ciphertext autokey systems.—a. All of the discussion on ciphertext autokey 
systems thus far has been limited to alphabetical systems employing sliding primary components (or 


why a set of 26 unrelated random 


the equivalent form of a square table). There is no reason, of course, 


sequences in a table such as that in Fig. 33, below, could not be used for the cipher alphabets. In such 
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AITOKZBLRXSPWNAQCEIGDJIF 
BISBACDEHFIJKTLMOUVYGZN 
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Plain 
HYDRAULICBEFGJKMNOPQSTVWXZ 


AIH YDRAULICBEFGJKMNOPQSTVWX 


BIYDRAULICBEFGJKMNOP 
CIDRAULICBEFGJKMNOPQ 








_ methods in pars. 23 and 24, except that it is obvious that (a) there will be no determinable base letter, 
DIRAULICBEFGJIKMNOPQSTVWXZHYD 
EIAULICBEFGJKMNOPQSTVWXZHYODR 


‘and (b) there will be no causal isomorphs. For that matter, even with a matrix such as that of Fig. 34 
below, in which the key letters are designated by arbitrary letters to the left of the square (instead of 


‘ eases, the general methods treated in par. 22 still apply, with necessary modifications, as also do the 
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Figure 34 


Message “‘A” 





SZDIYIHTHOUOUNARUNNME 
MSG DMAHOMARHUYD™M 
AMADAHUNAMRAU' 
AAMGDTIHOUMARKY 
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minable base letter and no causal isomorphs can be produced, as can be shown by the following 


the letters in a column under a particular plaintext letter—the base letter), there is likewise no deter- 
isologous message beginnings: 


om 


C: PMQQPPZFGTRIRZNDPQLJUYMLLHXQWGP 


Message ‘“B” 
71 


TTVULPAESJOUBNOADTEXPAQEFTU 


YIQNSTTVULPAESJOUBNOADTEXPAOEFT 
P: THIRDREGIMENTCOMMANDPOSTMOVING. 


Cc: QNS 


K: 
components are identical sequences, one of the distributions of the letters immediately following a 


particular cipher letter (in this case, A.) will fit the normal, since the plaintext letters enciphered by this 
key letter will be self-enciphered; the distributions of the letters following the other cipher letters will 


The ciphertext doublets are the result of chance. Note in this example that, since the plain and cipher 
of course be monoalphabetic. 
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b. The general principles of ciphertext autokeying apply equally well to digital systems, and for 
that matter to Baudot systems. The modulus in digital systems is the usual mod-10 arithmetic,” so 
that in effect the cipher component is a known sequence—thus a reduction to monoalphabetic terms 
suggests itself at once, if not sooner. 

c. As an example, let us study the following message, suspected of having been enciphered in a 
ciphertext autokey system with the additive method of encipherment (P+K=C).”’ 


15635 92001 13756 94093 05151 40094 
22123 30476 69720 39498 79929 58112 
7611149369 28072 48301 90074 45548 
40544 $1589 12943 50529 5281474516 
71932 40506 11682 05793 10649 25695 
19689 99661 


If a single-digit introductory key has been used, the cipher text is offset against itself at an interval of 1 
and a decipherment obtained, the beginning of which is shown below:”8 


K: oe 99200 11375 69409 30515 
ore 635 92001 13756 94093 05151 
P: 172 4380102481 35694 75646 


The I.C. of the entire deciphered message is 0.99, so the length of the introductory key was probably not 
1. The cipher text is then offset against itself at intervals of 2,3,4 . . ., up to an interval of 9: the I.C.’s 
obtained from the resulting decipherments are all unsatisfactory, as may be seen from the following 
table: 








76 Tf other than mod-10 arithmetic is used, say an arbitrary conversion-square encipherment with a square such as 
the following, 











Plain 

0123456789 
0/3167582490 
141235468907 
216402815379 
3\7329056184 
415840923716 
Key 58516790243 
6/2981374065 
714698207531 
819073641852 
910754139628 





the problem must be solved as a general case of ciphertext autokey as treated earlier in this chapter. (The conversion 
square shown here is a Latin square, with ten unique digits in each of the rows and in each of the columns; other conversion 
squares may have columns containing repeated digits.) 
27 As regards the effect of the use of different encipherment conventions, see subpars. 35g and hk (on pp. 117-120). 
28 We have assumed that the enciphering procedure was the additive method (i.e., wherein P+K=C); see also the re- 
marks in subpar. 35h in the next chapter if subtractive or minuend methods had been involved. 
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d. When an offset of 10 is tried, the I.C. of the deciphered text jumps to 1.52 and a long repetition 
. is in evidence, revealing that 10 is the length of the introductory key. The decipherment and its appertain- 


ing frequency distribution are shown below: 


owe 
oo oO 
ooo 
too 
o 10 


756 
151 


08121 02092 92405 


15635 92001 13 


C:15635 92001 13756 94093 05 


K: 
P; 


40094 22123 30476 69720 39498 
30476 69720 39498 79929 58112 


P: 27072 90482 47607 09022 10209 29724 


aM) 


K: 79929 58112 7611149369 28072 48301 
Cc: 7611149369 28072 48301 90074 45548 


P:07292 91257 52961 09042 72002 07247 


K: 90074 45548 40544 31529 12943 50 
C: 40544 31529 12943 50569 5281 
P: 50570 96081 72409 29040 4097 


K:52814 74556 71932 40546 11682 05733 
C: 71932 40546 11682 05733 10649 25635 
P: 29128 76090 40750 65297 09067 20902 


ood © 
NOR 
ooo 
1o © ~ 
Nor 


Onno 
vo x 
OoWo 
ono 
HHO 


MO AL 


HILT TU AT TRUTH 
7 THETA THU THE 

Ill © 

THUD THL TI 

HLTHE © 

MITE WO 

HHT HUT Nt 

”) 

THE TL THT TRL THE 
HTK A 


From here on the solution of the intermediate text is a simple matter; monome-dinome characteristics 


are observed in the preliminary examination, and recovery of the plain text and of the enciphering 


matrix quickly follow.” 


29 The analysis of the intermediate text is given in par. 77 of Military Cryplanalytics, Part I. 
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29. Preliminary remarks on plaintext autokeying.—«. If the cipher alphabets are unknown mixed 
sequences, plaintext autokeying gives rise to cryptograms of more intricate character than does cipher- 
text, autokeying, as has already been intimated in the preceding chapter. As a cryptographic principle, 
it is very commonly encountered as a new and remarkable ‘invention’ of tyros in the eryptographic 
art. It apparently gives rise to the type of reasoning to which attention has been directed once before, 
and which was then shown to be a popular delusion of the uninitiated. The novice to whom the plaintext 
autokey principle comes as a brilliant flash of the imagination sees only the apparent impossibility of 
penetrating a secret which enfolds another secret. His reasoning runs about as follows: ‘In order to 
read the cryptogram, the would-be solver must, of course, first know the key; but the key does not 
become known to the would-be solver until he has read the cryptogram and has thus found the plain 
text. Since this is reasoning around a circle, the system is indecipherable.” How unwarranted such 
reasoning really is in this case, and how readily the problem is solved, will soon be demonstrated. 

b. A consideration of the mechanics of the plaintext autokey method discloses that a repetition of 
n letters in the plain text will produce a repetition of (n—) letters in the cipher text, where n represents 
the length of the repetition and & the length of the introductory key. Therefore, when the introductory 
key consists of a single letter, there will be as many polygraphic repetitions in the cipher text as there 
are in the plain text, except for repetitions of digraphs only, which of course disappear. But on the other 
hand some accidental (i.e., noncausal) digraphic repetitions are to be expected, since it can happen that 
two different plaintext pairs, enciphered by different key letters, will produce identical cipher equivalents. 
Such accidental repetitions will happen less, frequently, of course, in the case of longer polygraphs, so 
that when repetitions of four or more letters are found in the cipher text they may be taken to be true 
or causal repetitions. It is obvious that in studying repetitions in a cryptogram of this type, when the 
introductory key is a single letter, a 5-letter repetition in the cipher text, for example, represents a 
6-letter word or sequence repeated in the plain text. When the introductory key is k letters in length 
then an n-letter repetition represents a repetition in the plain text of length (n+) letters. 

c. The discussion in this chapter will, as usual, be divided into two principal cases: (1) those in 
which the cipher alphabets are known, and (2) those in which they are unknown. Under each case the 
introductory key may consist of a single letter, a word, or a short phrase. Furthermore, in the solution 
of plaintext autokey systems there are important differences whether the components are identical 
sequences progressing in the same direction, or running against each other in opposite directions,or 
whether the components are two different sequences. In addition, complications.in solution are intro- 
duced when the wrong base letter is assumed, as will presently be demonstrated. 

. 80. Solution of plaintext autokey systems when known cipher alphabets are employed and the 
introductory key consists of a single letter.—a. Note the following plaintext autokeyed encipherment, 
wherein the introductory key is a single letter, of such commonly encountered words as COMMANDING, 
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BATTALION, DIVISION, and CAPTAIN, using two identical primary components (in this case direct 
standard alphabets), with base letter A: 





K: . BATTALION K: .DIVISION 
() P: BATTALION (2) P: DIVISION. 
Cc: .BIMTLTWB C:. LDDAAWB. 
K: . COMMANDING K: . CAPTAIN 
(3) P: COMMANDING. (4) P: CAPTAIN 
C: .QAYMNQLVT. C:.CPITIV 


The following characteristics may be noted:? . 

(1) The cipher equivalent of A, is the plaintext letter which immediately precedes A, (see the two 
A’s in BATTALION, in example 1 above). When the key is A, a plaintext letter is self-enciphered (see the 
first T, and the L, in example 1). 

(2) A plaintext sequence of the pattern ABA yields a doublet as the cipher equivalent of the final 
two letters (see IVI and ISI in DIVISION, in the second example). 

(3) Every plaintext trigraph having A, as its central letter yields a cipher equivalent the last two 
letters of which are identical with the initial and final letters of the plaintext trigraph (see MAN in 
COMMANDING, in the third example). . 

(4) Every plaintext tetragraph having A, as the initial and the final letter yields a cipher equivalent 
the second and fourth letters of which are identical with the second and third letters of the plaintext 
tetragraph (see APTA in CAPTAIN, in the fourth example; also ATTA in BATTALION, in the first example). 

b. (1) From the foregoing characteristics and the fact that a repetition of a sequence of n plaintext 
letters will yield, in the case of a one-letter introductory key, a repetition of a sequence of n—1 cipher 
letters, it is obvious that an easy method of solving this type of cipher is that of the probable word. 
Indeed, if the system were used for regular traffic it would not be long before the solution would consist 
merely in referring to lists of cipher equivalents of commonly used words (as found from previous mes- 
sages) and searching through the traffic for these sequences, aided by their idiomorphic patterns. 

(2) Note how easily the following message can be solved: 


BECJI BTMTL TWBPQ AYMNQ HVNET WAALC. 


We take note of the sequence BTMTLTWB, which is in the list of equivalents in subpar. a, above, and we 
insert the word BATTALION in the proper position. Thus: 


K BATTA LION 
Cc: BECJI BITIMTL TWBPQ 
P B ATTAL ION 


0 
With this as a start, the decipherment may proceed forward or backward with ease, as shown below: 


5 10 15 20 25 30 
K: EACH BATTA LIONC OMMAN DERWI LLPLA 
Cc: BECJI BIMTL TWBPQ AYMNQ HVNET WAALC. 
P: EACHB ATTAL IONCO MMAND ERWIL LPLAC 


ec. The foregoing example is based upon the normal Vigenére method of encipherment (6y,2.=61n; 
65 ~=6c/2). If in encipherment the plaintext letter is sought in the second (i.e., lower) component, and its 
equivalent taken in the first (i.e., upper) component (6,611; @p2=8en), the steps in solution are 
identical, except that the list of cipher equivalents of probable words must be modified accordingly. 


1 The reader is cautioned that the characteristics noted apply only to the case where two identical components are 
used, with the base letter A. 
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For instance if the components are direct standard sequences the word BATTALION will now be enciphered 
as BATTALION. 
' ZTAHLXGZ 
d. If reversed standard alphabets are used, the word BATTALION will be enciphered as BATTALION 
BHATPDUB 
which also presents idiomorphic characteristics leading to the easy recognition of the word in the cipher 
texts of messages. 

e. All of the foregoing phenomena are based upon standard alphabets, but when mixed cipher alpha- 
bets are used and these have been reconstructed, similar observations may be recorded and the results 
employed in the solution of additional messages enciphered by the same components. 

f. (1) Let us again consider the case of known components wherein two identical sequences progress 
in the same direction; for the sake of illustration, let both of these sequences be normal sequences. Let it 
also be known that plaintext autokey with a single-letter introductory key is involved, and that the 
enciphering equations are those of the normal Vigenére method. 

(2) A message beginning QVGLBTPJTF . . . is intercepted; the only unknown factor is the initial 
key letter. Of course, one could try to decipher the message using each key letter in turn, beginning 
with A and continuing until the correct key letter is tried, whereupon plain text will be obtained. But it 
seems logical to think that all 26 possible ‘“‘decipherments”’ might be derived from the first one, so that the 
process might be much simplified; this is true, as will now be shown. If we take the two cipher groups 
under consideration and decipher them with initial key letter A, we obtain the following: 


K: AQFBKRCNW 
C: QVGL J 
P: QFB 


x 
BTPJTF. 
KRCNWXI 
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The deciphered text is certainly not plain text. But if one completes the sequences initiated by these 
letters, using the direct standard sequence for the even columns, the reversed standard for the odd columns, 
the plain text HOSTILE FOR(CE) will appear in one generatrix. From this it is clear that instead of going 
through the labor of making 26 successive trials, which would consume considerable time, all that is 
necessary is to have a set of strips bearing the normal direct sequence and another set bearing the reversed 
normal sequence, and to align the strips, alternatively direct and reversed, to the first ‘‘decipherment.” 
The plain text will now reappear on one generatrix of the completion diagram, as shown in Fig. 35, below: 


Initial 13 2 3 4 5 678910 
keyltr QVGLBTPJTF 
A QFBKRCNWXI 
B PGALQDMXWJ 
Cc OHZMPELYVK 
D NIYNOFKZUL 
E MJIXONGJOATM 
F LKWPMHIBSN 
G KLVQLIHCRO 
H JMURKJGODQP 
I INTSJKFEPQ 
J *HOSTILEFOR 
K GPRUHMDGNS 
L FQQVGNCHMT 
M ERPWFOBILU 
N DSOXEPAJKV 
0 CTNYDQZKJIW 
P BUMZCRYLIX 
Q AVLABSXMHY 
R ZWKBATWNGZ 
Ss YXJCZUVOFA 
T XYIDYVUPEB 
U WZHEXWTQODC 
V VAGFWXSRCD 
W UBFGVYRSBE 
xX TCEHUZQTAF 
Y SDDITAPUZG 
Z RECJSBOVYH 
Ficure 35 


g. The peculiar nature of the phenomenon just observed, viz., a completion diagram with the vertical 
sequences in adjacent columns progressing in opposite directions, those in alternate columns in the same 
direction, calls for an explanation. Although the matter might seem a bit mysterious, it is not hard to 
understand. First, it is clear why the letters in column 1 of Fig. 35 form the descending 


sequence QPO . . . these letters are merely the ones resulting from the successive “decipherment”’ 
of Q, by the successive key letters A, B, C . . ., as shown below: 
Initial key A Initial key B: Initial key C: 
K: AQF BKRCNWX K: BPGALQDMXW K: COHZMPLEYV 
Cc: @VGLBTPJTF Cc: QVGLBTPJTF C: QVGLBTPJTF 
P: QFBKRCNWXI P: PGALQDMXWJ P: OHZMPELYVK 


Now since the decipherment obtained from the Ist cipher letter in any row in Fig. 35 becomes the key 
letter for deciphering the 2d cipher letter in the same row, it is apparent that as the letters in the Ist 
column progress in a reversed normal (i.e., descending) order, the letters in the 2d column must progress 
in a direct normal (i.e., ascending) order. The matter may perhaps become more clear if encipherment 
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is regarded as a process of addition, and decipherment as a process of subtraction. Instead of primary 
components or a Vigenére square, we may use mod-26 arithmetic, assigning numerical values to the 
letters of the alphabet, beginning with A=§ and ending with Z=25. For example, if we consider the usual 
Vigenére enciphering equations 0,261; 0pn=6en, the letter H, enciphered by key letter My with direct 
standard alphabets yields T,; or, by using the following numerical values, 


ABCDEFGHIJKLMNOPQRSTUVWXYZ_ 


012 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 2 21 22 23 24 25 


the same result may be obtained thus: Hp(Mx)=7+ 12=19=T,, (Every time the number 25 is exceeded in 
addition, we subtract 26 from it and find the equivalent for the remainder.) In decipherment, the process 
is one of subtraction.? For example, T.(Mx)=19—12=7=H,; D.(Rx)=3—17= (26+ 3)—17=29—-17= 
12=M,. Using this arithmetical equivalent of normal sliding-strip encipherment, the phenomenon just 
noted can be set down in the form of a diagram (Fig. 36) which perhaps will make the matter clear. 








Q. (Ax) =16- 0=16=Q - QF 

Ve (Qs) =21-16= 5=F 

G. (Fy) = 6 5= 1=B 

L, (Bx) =11- 1=10=K 

B,. (Kx) = 1-10=17=R 
* © & & ¥ 

Q. (Bx) =16— 1=15 

Vv. (Py) =21-15= 

G. (Gx) = 6 6= 0 ; 

L, (Ax) =11- 0=11=L me 

B. (Ix) = 1-11=16=Q a, 
Be IR Ree HER HK HH KH HH HH 

Q. (Cy) =16- 2=14=0 ~OHZMP 


V. (Ox) =21-14= 7=H 
G. (Hy) = 6- 7=25=Z 
L. (Zy) =11-25=12=M 
B, (M,) = j-12=15=P 


Figure 36 


Note how homologous letters of the three rows (joined by vertical dotted lines) form alternately de- 
scending and ascending normal sequences. 


h. But now let us consider what happens when the base letter is incorrectly assumed. Note the 
following direct standard alphabet encipherments: 


] 


ao 
% 
® 


etter B: Base letter C: Base letter D: 
K: JHOSTILEFQO K: JHOSTILEFO K: JHOSTILEFO 
P:- HOSTILEFOR P: HOSTILEFOR P- HOSTILEFOR 
C: PUFKASOISE Cc: OTEJZRNHRD C:-NSDIYQMGQC 
Ficurer 36a Ficure 36b Ficure 36c 


2 It will be noted that if the letters of the alphabet are numbered from 1 to 26, in the usual manner, the arithmetical 
method must be modified in a minor particular in order to obtain the same results as are given by employing the normal 
Vigenére square. This modification consists merely in subtracting 1 from the numerical value of the key letter. Thus: 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
12 8 4 5 6 7 8 9% 10 11 12 1814 15 16 1718 19 20 21 22 23 2% 25 2 


Hp(Mk) = 8 + (13 - 1) = 8+ 12 = 20 = Te 
To(Mk) = 20 - (13 -1) = 20 - 12 = 8 = Hp 
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When we make our initial ‘‘decipherments” of the foregoing cipher texts, assuming erroneously that 
the base letter is Ap, we have the following: 


K: APFAKQCMWW K: AOFZKPCLWYV K: ANFYKOCKW®U 

C: PUFKASOISE C: OTEJZRNHRD C:NSDIYQMGQC 

P: PFAKQCMWW5HI P: OF ZK PCLYWVI P: NFYKOCKWUI 
Figure 37a Figure 37b Ficurer 37c 


Note that the even letters FKCWI of these three decipherments match. When we make generatrix dia- 
grams from these decipherments, it may be seen in Figs. 38a—c, below, that the true plain text appears 
on two generatrices, and that the interval between these generatrices reflects the identity of the par- 
ticular base letter involved. This phenomenon holds true only for those cases in which the plain and 
cipher components are identical sequences running in the same direction. 


PUFKASOISE OTEJZRNHRD NSDIYQMGQC 
PFAKQCMWWI OFZKPCLWVI NFYKOCKWUI 
QEBJRBNVXH PEAJQBMVWH OEZJPBLVVH 
RDCISAOUYG QDBIRANUXG PDAIQAMUWG 
SCDHTZPTZF RCCHSZOTYF QCBHRZNTXF 
TBEGUYQSAE SBDGTYPSZE RBCGSYOSYE 
UAFFVXRRBD TAEFUXQRAD SADFTXPRZD 
VZGEWWSQccec UZFEVWRQBC TZEEUWQQAC 
WYHDXVTPDB VYGDWVSPCB UYFDVVRPBB 
XXICYUUOEA WXHCXUTODA VXGCWUSOCA 
YWJBZTVNFZ XWIBYTUNEZ WWHBXTTNDZ 
ZVKAASWMGY YVJAZSVMFY XVIAYSUMEY 
AULZBRXLHX ZUKZARWLGX YUJZZRVLFX 
BTMYCQYKIW ATLYBQXKHW ZTKYAQWKGW 
CSNXDPZJJV BSMXCPYJIV ASLXBPXJHV 
DROWEOAIKU CRNWDOZIJU BRMWCOYIIU 
EQPVFNBHLT DQOVENAHKT CQNVDNZHJT 
FPQUGMCGMS EPPUFMBGLS DPOUEMAGKS 
GOR@HOD@N® FORMGCOcMHu® EORPOFOBOL® 
QOnOS@K@BEOR GNRSHKDENQ FNQSGKCEMQ 
IMTRJJFDPP @M@R@JI®DOP GMRRHJDDNP 
JLUQKIGCQO ILTQJIFCPO @LOA@I®@cgOo 
KKVPLHHBRN JKUPKHGBQN IKTPJHFBPN 
LJIWOMGIASM KJVOLGHARM JJUOKGGAQM 
MIXNNFJZTL LIWNMFIZSL KIVNLFHZRL 
NHYMOEKYUK MHXMNEJYTK LHWMMETIYSK 
OGZLPDLXVJ NGYLODKXUJ MGXLNDJXTJ 
Fiaure 38a Fiegurt 38b FIGURE 38c 


2. When the method of encipherment based upon enciphering equations @4;2=611; 9p2=8en is used 
instead of that based upon the usual Vigenére equations, the process indicated above is simplified by the 
fact that no alteration in the direction of the sequences in the completion diagram is required. For ex- 
ample, if the first two groups of a cipher message were YHEBP DTBJD the ‘“‘decipherments” with key 
letters A and B, respectively, are shown below: 


ov Eee K: BZGKLADWXG 
C: YHEBPDTBJ . C: YHEBPDTBJD 
P: YF JKZCVWFEF P: ZGKLADWXGJ 





The entire completion diagram would therefore be as follows: 


Initial 
key ltr. 


* 


NSM SS CHNWOVOARITAVHTAAwDYV Awe 

SAMS CHNDWOVSO AZ RORGHIBQDHAVAWPN KK 
FOOQWPFNKH KH SS CHNDWOVSI AZ SOPRA TA Bmw 
HIODQYAOCQWEPNK HSS CHHNDAWAOVSEZ EES Ulm © 
GHOIOQDAAOCAQWPNKH KH SS CHNWOVOZEE Rly 
KMxSM SCS CHHDAOHVSOCZ EMP RUHAANDAGAWPNI\[W:a 
WrPNK XM SKS CHNAAOVSIOAZA SOCAN TAAMIVAlY @ 
GCHAHANAHVAOZSZMTAGHEOQDAHAVIAQAWPN Kh Sys 
SSHHNDWOVOZEZORGH RON YADAVQODP NH Slo om 
AUDUQWPNK HSS CHNAWOVSIAZEOMARUH IAA © 
GTOQBAAVIQWDPNK MSS CHUNWMWOVIO ASA aHly s 


Figure 39 


j. (1) In the foregoing examples the primary components were normal sequences, but the case of 
identical mixed components may be handled in a similar manner. Note the following example, based upon 


HYDRAULICBEFGJKMNOPQSTVWXZ 


the primary component which we have reconstructed from previous work. Let the first two groups of an 
intercepted message be XOFMD JNTDS . 
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(2) First, the message is “deciphered” with the initial key letter A and base letter H,, and then a 
completion diagram is made, using sliding strips bearing the mixed primary component, alternate strips 
bearing the same sequence in reverse. Note Fig. 40, in which the plain text HOSTILE FOR(CE) reappears 
on a single generatrix. 


W 


ree 
aoe 
N > 


aw 
ras 


E 
Xx 


US 
No 
VAR 


K 
C: 
P 


* 
IDO 7 OP > 


* 


OVSCARAGCONAAWAAHMrCPWON IN SM SASHA) PD 
SNIKOMWPCrTHAQWM ANU REZOCVyvonw<s BION 
GQ9NAWAHTCrPWUN INH SSH KHNOVOSESARIY 
ODAPrPCKMrHAWDMANQUCRREZCvOHAS SxONDKER 
TN FS SHNOVOZSRUODNDAWAHKPT Cr AwWOH|O x 
GHIQAAVCQWEPNK KM SKM CHHNMOVOZABEORHY 
SECO RGHTAQ DAVAO PNK eM SKI CHHWOVOlSZR 
SARTO RGHIEOQDAMVUAWPNK KM SS CHHNWO'V 
DTAWPNK KH SKS CHHNWOVIOZEMrRUH TOAD 
* 

GrPAWAOKTNM SKS ANOVOAZAEZERAYVQBDAWAHOC|S > 
Q1AAWDAHETCRP AUN INHKX SS HANO VO SARA K 
AAWDAHCCrPAOK INKS SHANOVOZARGAWG 


G 
V 
N 
0 
P 
Q 
S 
T 
V 
W 
x 
Z 
H 
Y 
D 
R 
A 
U 
L 
I 
C 
B 
E 
F 
G 
J 
K 
M 


URE SOUVOUVYHHAS SHYNTNCOWDPCKOKHQWDWAAMIAK 
AUK INKMSSHANOVOARRUANMAAWANYE CG PlZ | 
VORA SMNEKUARPCKrHQWHABDHQUARE SOW SP 
FIWQHOCrPAUONKX TNR SE SHHNOVOZERAUMD Divo 
MPANGREVZOVOVnHAS SHNEDTKODMrPCrHaAWwl 
NEM SS CHHNWOVOIO ASM RGHUMANBAMIOADeS 

PNK KM SSCHAHNWOVIO ZA RO ARAUHETHAMIADW 

GHIEQDAAOQWPNK KH SS CHNWOVOIZEON 

ZSOrRGCHIUOQMACQWPNNK HM BKM CHHAOVEOA 

SHNOVOZAEZRAGCQAAWAHET AYP WONHMIN «Sloe 
NMSA HNO VO ZZRUNQAAWAHOCCrPADOK TIS Ss 
ITNX SSH NOVO ZZ RAUNDNDMAWAHYP CrP WDOH(N = 
SZ2ERECQABAWQAHMCrFADAOK INH SKS HANHOVOIN & 
SHAHNO VOSA ARGO YAAWAAHOYVT GOST DAONXTN&€ BNO 
QHOeOGSF WOH IN KSSH NOVO AZAAZRAUOD AMA SB 


H 
I 
J 
K 
L 
M 
N 
0 
P 
Q 
R 
Ss 
T 
U 
Vv 
Ww 
Xx 
Y 
Z 
A 
B 
C 
D 
E 
F 
G 


AWPFNK KH SP CHNWOVOAZORGH 


Fiaure 40 Ficure 41 Figure 42 


k. (1) Next to be considered is the case in which the two primary components progress in opposite 
directions. Let us assume that XTWZL XHZRX . . . are the first two groups of a message known to 
have been enciphered by plaintext autokeying with a single letter introductory key and reversed standard 
alphabets. The procedure in this case is exactly the same as before, except that it is not necessary to 
have any alternation in direction of the completion sequences; note the solution in Fig. 41. Let the student 
ascertain why the alternation of the completion sequences is not necessary in this case. 

(2) In the foregoing case the alphabets were reversed standard, produced by the sliding of the 
normal sequence against its reverse. But the underlying principle of solution is the same even if a mixed 
sequence were used instead of the normal; so long as the sequence is known, the procedure to be followed 
is exactly the same as demonstrated in subpar. (1), above. For example, let the reconstructed primary 
components be 


P: HYDRAULICB FGJKMNOPQSTVWXZ 
C:ZX¥WVTSQPONMKJGFEBCILUARDYH 
and let the first two groups of an intercepted message be XBWZK YVZSK . . . . Referring to Fig. 42, 


we may note that the primary mixed sequence is used for the completion sequence and that the plain 
text, HOSTILE FOR(CE), comes out on one generatrix. It is immaterial whether the direct or reversed 
mixed component is used for the completion sequence, so long as ad/ the sequences in the diagram progress 
in the same direction. 
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l, When the enciphering alphabets are identical sequences but running against each other in opposite 
directions, an incorrectly assumed base letter has an effect on the same manner of reading the generatrix 
diagrams. In Fig. 41, above, we assumed correctly that the base letter was A,, and the plain text re- 
appeared on a single generatrix. If, however, we had assumed the base letter to be B,, our generatrix 
diagram would have been that of Fig. 43a, below; and if we had assumed a base letter of Cy, the gen- 
eratrix diagram would have been that of Fig. 43). Note that the plain text in Fig. 43a progresses upward 
on a simple diagonal, while that in Fig. 436 progresses upward on a steeper diagonal, two rows apart. 
The diagonal for an assumed base letter of D, would have been three rows apart, and that for an assumed 
base letter of E, would have been four rows apart, and so on: this shows that the angle of reading the 
diagonal, then, depends upon the distance between the true base letter from the assumed base letter, 
as measured on the component. 


K: AEMRTJNHJT K: AFOUXOTORC 
C: XTWZLXHZRX C:XTWZLXHZRX 
P: EMR@JNHJTX P: FOUXOTORCH 
FNO©UKOIKUY GPVYPUPSDI 
GO@TVLPJLVZ @MQwWZQVQTEJ 
@MPUWMQKMWA IRXARWRUFK 
IQVXNRLNXB JSY ES zs SV CL 
JRWYOSMOYC KTZCTYTWHM 
KSXZPTNPZD LUADUZUXIN 
LTYAQUOQAE MVBEVAVYJO 
MUZBRVPRBF NWCFWBWZKP 
NVACSWQSCG OXDGXCXALQ 
OWBDTXRTDH PYEHYDYBMQ® 
PXCEUYSUEI QZFIZEZCNS 
QYDFVZTVFJ RAGJAFAD@®T 
RZEGWAUWGK SBHKBGBEPU 
SAFHXBVXHL TCILCHC®@®aqQv 
TBGIYCWYIM UDJMDIDGRW 
UCHJZDXZJIN VEKNEJ@HSX 
VDIKAEYAKO WFLOFKFITY 
WEJLBFZBLP XGMPGQOGJUZ 
XFKMCGACMQ YHNQHMHKVA 
YGLNDHBDN® ZIOR@NILWB 
ZHMOEICEQ@S AJPSJOJMXC 
AINPFJD@®PT BKQ@KPKNYD 
BJOQGK®@GQuU CLRULQLOZE 
CKPRHDFHRV DM@VMRMPAF 
DLQS@MGISW ENTWNSNQBG 
FIGurF 43a Fiaureé 43) 


m. (1) There remains now to be considered only the case in which the two components are different 
mixed sequences. Let the two components be 


P:HYDRAULICBEFGJIKMNOPQSTVWXZ 
C:QUESTIONABLYCDFGHJKMPRVWXZ 


and let us examine the cipher text resulting from the following encipherment: 


K: XHOSTILEFO 
P:HOSTILEFOR 
C: XNQXYYPODIB 
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(2) First “decipher” the message in plaintext autokey fashion with any arbitrarily selected initial 
key letter, say A, assuming the base letter to be H,, the initial letter of the plain component. Now in the 
first column, under the first decipherment, complete any arbitrary 26-letter sequence (in this example, 
the normal sequence), as shown in Fig. 44a, below. 


K: ANHEVMPHWC K: ANHEVMPHWC K: ANHEVMPHWC 
Cc: XNQXYYPODIB C: XNQXYYPODIB Cc: XNQXYYPODIB 
P: NHEVMPHWCW P: NHEVMPHWCW P: NHEVMPHWCW 

0 oY OYMU 

P PJ PJBM 

Q QI QITsS 

R RG RGFE 

S SA_ SAPA 

T TR TRUW 

U UL ULNO 

Vv VF VFGB 

W WE WEXH 

xX XB X BOP 

XY YV YVAN 

Z ZC ZCKL 

A A Z AZYJ 

B B X BXDF 

C cT cTVD 

D DS DSWY 

E EU EUZZ 

F FQ FQHC 

G GP GPLK 

H H 0 *HOST 

I ID IDJI 

J JIN JNQX 

K KM KMIQ 

L LW LWRR 

M M K MKCG 

Figure 44a Figure 446 Figure 44c 


Then prepare a strip bearing the cipher component reversed, and set it below the plain component so that 

H,=N,, a setting given by the first two letters of NHEVMPHWCW, the spurious plain text obtained by the 

arbitrary decipherment with the key letter A. Thus: 
P:/H}YDRAULICBEFGJKMNOPQSTVWXZ 
C: OITSEUQZXWVRPMKJHGFDCYLBA 


(3) Now opposite each letter of the completion sequence in column 1, write in column 2 its plain- 
component equivalent, as given by the juxtaposed sequences above. This gives what is shown in Fig. 440. 
Then reset the two sequences so that E,=H, (to correspond with the 2d and 3d letters of the spurious 


P: HYDRAULIC B/E)/FGJKMNOPQSTVWXZ 
Cc: QZXWVRPMKJAHGFDCYLBANOITSEU 


plain text); write down the plain-component equivalents of the letters in column 2, forming column 3. 
Continue this process, scanning the generatrices from time to time, resetting the two components and 
finding equivalents from column to column, until it becomes evident on what generatrix the plain text 
is reappearing. In Fig. 44c it is seen that the plaintext generatrix is the one beginning HOST; from this 
point on, the solution may be obtained directly, by using the two primary components. 
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n. When two different components are involved, if the base letter is incorrectly assumed there is 
nothing much that can be done about it except tedious trial and error. There are no shortcut procedures 
such as those exemplified in subpars. A or J: successive base letters with their corresponding generatrix 
diagrams must be tried in turn, until a solution is forthcoming. 

o. Another “mechanical” solution for the foregoing cases will now be described because it presents 
rather interesting cryptanalytic sidelights. Let us take the message “REFERENCE HIS PREFERENCE 
IN REFERENCE BOOKS AND REFERENCE CHARTS .. .” and encipher it by plaintext autokey, with 
direct standard alphabets, A, as the base letter, and the single-letter initial key A,=G,. Then note the 
underscored repetitions: 


5 10 15 20 25 30 
K: GREFERENCEHISPREFERENCEINREFERENC 
P: REFERENCEHISPREFERENCEINREFERENCE 
Cc: X¥VJIJVVRPGLPAHGVJJVVRPGMVEVJJVVRPG 
35 40 45 50 55 
K: EBOOKSANDREFERENCECHART 
P: BOOKSANDREFERENCECHARTS 
C: FPCYCSNQUVJIJVVRPGGJHRKL 


Now suppose the message has been intercepted and is to be solved, assuming that the only unknown 
factor is the initial key letter. Let the message be ‘‘deciphered’”’ by means of any initial key letter,? say 
A;, and then note the underscored repetitions in the spurious plain text: 


5 10 15 20 25 30 
K: AXYLYXKYTWKBOMVLKZKLKHIYOHXYLYXYTW 
Cc: X¥VJIJVVRPGLPAHGVJJVVRPGMVEVJIJVVRPG 
P: XYLYXYTWKBOMVLKZKLKHIYOHXYLYXYTWK 
35 40 45 50 55 
K: KVUIQMGHJLKZKLKHIYIBGLZ 
Cc: FPCYCSNQUVJIJIVVRPGGJHRKL 
P: VUIQMGHJLKZKLKHIYIBGLZM 


The original four 8-letter repetitions now turn out to be two different sets of 9-letter repetitions. This 
calls for an explanation. Let the spurious plain text, together with its real plain text, be transcribed as 
though we were dealing with a periodic cipher involving two alphabets, as shown in Fig. 45, below: 


12022 42 32 212 22 22 12 12 12 12 12 12 «12 
XY LY XY TW KB OM VL KZ KL KH IY OH XY LY 
RE FE RE NC EH IS PR EF ER EN CE IN RE FE 


XY TW KV UI QM GH JL KZ KL KH IY IB GL ZM . 
RE NC EB OO KS AN DR EF ER EN CE CH AR TS 


Figure 45 


It will here be seen that the letters in column 1 have been monoalphabetically enciphered, as have been 
those in column 2. In other words, an autokey cipher, which is an aperiodic polyalphabetic substitution, 
has been converted into a 2-alphabet periodic polyalphabetic substitution. The two repetitions of 
XYLYXYTWK represent encipherments of the word REFERENCE, in alphabets 1-2—1-2—1-2-1-2-1; the 
two repetitions of LKZKLKHIY likewise represent encipherments of the same word but in alphabets 
2-1-2-1~2-1-2-1-2. Later on it will be seen how this method of converting an autokey cipher into a 
periodic cipher may be applied to the case where an introductory key word is used as the initial keying 
element instead of a single letter, as in the present case. 


3 Except the actual key letter or a letter 13 intervals from it. If the actual key letter is used, we will of course obtain 
plain text; if we use the letter 13 intervals away from the actual key letter, the cipher text will be converted to mono- 
alphabetic terms. (See subpar. 7, below.) 
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p. The student has probably already noted that the phenomena observed in the preceding sub- 
paragraph are the same as those observed in subpar. g, in which it was seen that the direction of the 
sequences in alternate columns had to be reversed in order to bring out the plain text on one generatrix. 
If this reversal is not done, then obviously the plain text would appear on two generatrices, which is 
equivalent to having the plain text reduced to two monoalphabets. 

q. When reciprocal components are employed, the spurious plain text obtained by “decipherment”’ 
with a key setting other than the actual one will be monoalphabetic throughout. Note the following 
encipherment (with initial key A,=G,, using reversed standard alphabets) and its ‘‘decipherment” by 
setting the two components at A,=A,. 


P :REFERENCEHISPREFERENCE. 
C :PNZBNNRLYXZQDYNZBNNRLY. 
"Pr >: LYZYLYHWYBCMJILYZYLYHWY. 


Here the spurious plain text is wholly monoalphabetic. 

r. The reason for the exception noted in footnote 3 in subpar. o now becomes clear. For if the actual 
initial key letter (G) were used, of course the decipherment yields the correct plain text; if a letter 13 
intervals removed from G is used as the key letter, the cipher alphabet selected for the first “decipher- 
ment” is the reciprocal of the actual initial cipher alphabet and thereafter all alfernate cipher alphabets 
are reciprocal. Hence the spurious plain text obtained from such a “‘decipherment”’ must be mono- 
alphabetic. 

s. In the example illustrated in subpar. 0, the primary components were identical normal sequences 
progressing in the same direction. If they were mixed sequences, the phenomena observed above would 
still hold true, and, so long as the sequences are known, the indicated method of solution may be applied. 
When the two primary components are known but differently mixed sequences, this method of solution 
is too involved to be practical. It is more expedient to try successive initial key letters, noting the plain 
text each time and resetting the strips until the correct setting has been ascertained, as will be evidenced 
by obtaining intelligible plain text. 

31. Solution of plaintext autokey systems involving known cipher alphabets when the introductory 
key consists of several letters.—a. In the foregoing discussion of plaintext autokeying, the introductory 
key was assumed to consist of a single letter, so that the subsequent key letters are displaced one letter 
to the right with respect to the text of the message itself. But sometimes a word or phrase may serve 
this function, in which case the subsequent key is displaced as many letters to the right of the initial 
plaintext letter of the message as there are letters in the introductory key. This will not, as a rule, inter- 
fere in any way with the application of the general principles of solution set forth to that part of the 
cryptogram subsequent to the introductory key, and a solution by the probable-word method and the 
study of repetitions can be reached. However, it may happen that trial of this method is not successful 
in certain cryptograms because of the paucity of repetitions, or because of failure to find a probable 
word in the text. When the cipher alphabets are known, there is another point of attack which is useful 
and interesting. The method consists of finding the length of the introductory key and then solving by 
frequency principles; this method will be described in the subparagraphs below. 
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b. Suppose that the introductory key word is the 10-letter word PARLIAMENT, that the plaintext 
_ mnessage is as below, and that identical primary components progressing in the same direction are used 
to encipher the message, with the normal Vigenére enciphering convention. Let the components be the 
normal sequence. The encipherment, shown here written out on a width of 20 (ie., twice the length of 
the introductory key) is as follows: 


12 3 4 5 6 7 8 9 10 11 12 18 14 15 18 17 18 19 2 
K: PARLIAMENTRECEIVINGH 
P:RECEIVINGHEAVYARTILL 
C:GETPQVURTAVEXCIMBVRS 
K: EAVYARTILLERYFIREONM 
P: ERYFIREONMYLEFTFLANK 
C: TIRTDIIXWYXCCCKBWPOAW 
K: YLEFTFLANKSTOPENEMYI 
P: STOPENEMYISMASSINGHI 
Cc: QESUXSPMLSKFOHWVRSFQ 
K: SMASSINGHISTROOPSTOL 
P: STROOPSTOLEFTFRONTAN 
Cc: KFRGGXFZ2VTWYKTFDFMOY 
K: EFTFRONTANDCONCENTRA 
P: DCONCENTRATINGARTILL 
C: HHHSTSAMRNWKBTCVGBCL 
K: TINGARTILLERYTHEREST 
P: ERYTHERESTOPREINFORC 
Cc: XZLZHVKMDESGPXPRWSJV 
K: OPREINFORCEMENTSIMPE 
P: EMENTSIMPERATIVETOHO 
C: SBVRBFNAGGVMXVOWBAWS 
K: RATIVETOHO 

P: LDPOSITION 

Cc: CDIWNMMWVB 


It will now be noted that, since the introductory key consists of 10 letters, the 11th letter of the message 
is enciphered by the Ist letter of the plain text, the 12th by the 2d, and so on. Likewise, the 21st letter is 
enciphered by the 11th, the 22d by the 12th, and so on. An important step in the solution of a message 
of this kind would therefore involve ascertaining the length of the introductory key. This step will now 
be explained. 

c. Since the plain text itself constitutes the key letters in this system (after the introductory key), 
these key letters will occur with their normal frequencies, and this means that there will be many oc- 
currences of E, T, N, R, 0, A, I, S, enciphered by E,; there will be many occurrences of these same 
high-frequency letters enciphered by Tx, by Nx, by Rx, and so on. In fact, the number of times each of 
these combinations will occur may be calculated statistically. With the enciphering conditions set forth 
under subpar. ), above, if E, is enciphered by Tx, for example, it will yield the same cipher equivalent as 
T, enciphered by E,; in other words, two encipherments of any pair of letters of which either may serve 
as the key for enciphering the other must yield the same cipher resultant.‘ It is the cryptographic effect 


4Itis important to note that this observation applies only to cases in which the two components are zdentzcal sequences 
progressing in the same direction; if this is not the case, the entire reasoning is inapplicable. 
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of these two phenomena working together which permits ascertaining the length of the introductory key 
in such a case. For every time a given letter, @,, occurs in the plain text, it will occur 7 letters later as a 
key letter, 9,, where n equals the length of the introductory key. Note the following illustration: 






1 2 3 4 5 6 7 8 $$ 1012 3 4 «5 6 7 8 § W 

(1) &K: RLIAMEN TWEE). 

(2) 2: . Qe ®). 

(3) Or 2 Boa. 2 ew ee a cB 

(1) K: 

(2) P: 

(3) C: 

(1) K: 

(2) P: 

(3) C: 


It may be seen that the key-plain combination A,(E,)=E,, yields the same cipher resultant 10 positions 
later as the combination E,(A,)=E,; likewise, I,(A,)=I., and 10 positions away, A,(1I,)=I,; also, 
E,(L,)=P,, and 10 positions later we have the same cipher resultant from L,(E,)=P,. Two identical 
cipher letters at an interval equal to the length of the introductory key is a function of the key-plain 
reversibility just demonstrated. But not every pair of identical letters in the cipher text represents a 
case of this type. For in this system, identity in two cipher letters may be the result of the following three 
conditions each having a statistically ascertainable probability of occurrence: 

(1) A given plaintext letter is enciphered by the same key letter two different times, at an interval 
which is purely accidental; the cipher equivalents are identical, but could not be used to give any infor- 
mation about the length of the introductory key. 

(2) Two different plaintext letters are enciphered by two different key letters; the cipher equivalents 
are fortuitously identical. 

(3) A given plaintext letter is enciphered by a given key letter, and later on the same plaintext letter 
serves to encipher another plaintext letter which is identical with the first key letter; the cipher equiva- 
lents are causally identical. 
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d. It can be proved that the probability for identities of the third type, for that interval which corre- 
sponds with the length of the introductory key, is greater than that for identities of either or both 1st and 
2d types; that is, if a tabulation is made of the intervals between identical letters in such a system as 
the one being studied, the interval which occurs most frequently should coincide with the length of the 
introductory key. In a random case, i.e., cases (1) and (2), above, the probability of a ciphertext identity 
is for all intents and purposes 1/26 or .0385, whereas in the causal case (case 3, above) the probability 
is the kappa plain of the language, which for English is .0667 or 1/15. As a practical demonstration of 
this point, let us transcribe the cipher text of the message in subpar. } on trial widths; those for widths 
of 7, 8, 9, and 10 are shown in Fig. 46, below: 


12 8 4 6 6 7 #%4.1t2 3 4 56 6 7 8 123 4 56 6 7 8 9 123 4 56 6 7 8 9 10 
GETPQVU GETPQVUR GETPQVURT G@®TPQVURTA 
RTAWEXC TAVEXCIM AVEXCIMBV V@®@XCQ@MBVRS 
IMBWRSI BVRSIRTD RSIRTDIIX IRTD(A)IXWYX 
RTDIIXW IIXWYxcC WYXCCCKBW CCCKBWROAW 
YXCCCKB CKBMPOAW POAWQESUX QESUXS(P)MLS 
WPOAWQE QESUXSPM SPMLSKFOH Q(ROHWVRSFQ 
UXSPML LO©@KFOHWV WVRSFQKFR(KXYPRGGXPZVT 
KPOHWV ROWQKFRG GGXFZVTWY WYKTFD oY 
RS(QKFR GXPZVTWY) KTFDFMOYH HHHSTSAMRN 
GGXFZVT KT®DFMO See eae ee 
WYKTFDF HHHSTSAM WKB(MCVGBC XZLZHWKMDE 
MOYHHHS RNWKBTCV LXZLZHVKM @GPXPRWSJV 
TSAMRNW GBCLXZLZ DESGPXPRW (GSBVRBFN@GG 
KBTCVGB HVKMDESG SJVSBVRBF VMXVOWB(A@WS 
CLXZLZH PXPMWSJV NAGGVMXVO CDIWNMMWVB 
VKMDE@®G SBWYR)BFNA WBA@WSCDIW 
PXPRW(S)J GGWMXVO@ NMM@®VB 
VSBVRBF BAWSCDI(W@) 
NAGGVMX NMMWVB 
VOWBAWS 
CcDIWNMM 
WVB 

Fieure 46 


In each transcription, every pair of superimposed letters is noted and the number of identities is indicated 
by circling the letters involved, as shown above. In the diagram below, w is the trial width, C the number 
of comparisons, r the random expectation (obtained by dividing C by 26), p the expectation if the 
width is correct (obtained by dividing C by 15), and 2 is the observed number of identities. It is obvious 
that the width of 10 is probably the correct width. 





w Cc r p t 
7 143) 5.5 9.5 4 
8 142/)5.5 9.5 8 
9 141 | 5.4 9.4 2 

10 140 | 5.4 9.3 10 
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e. Once we have found the length of the introductory key, two lines of attack are possible if the 
enciphering alphabets are known: (1) completion of the plain-component sequence on the columns of the 
correct write-out, or (2) conversion of the aperiodic cipher text to periodic terms and its solution as a 
repeating-key cipher. The first line of attack will be discussed first, using the cipher message of subpar. b 
as an example. 

f. The cipher letters of column 1 and column 2 (of the write-out on a width of 10) are written in a 
row, and the key of A is arbitrarily chosen to start an autokey decipherment of the letters. Then, from 
these decipherments, the plain-component sequence is completed on the assumption of direct standard 
alphabets, running alternate columns in the reverse direction, as shown in Figs. 47a and b, below: 








Column 1 Column 2 
K: AGPTJHDHPSETZTC K: AEARLTMTFCIRPMA 
Cc: GVICQKKWHWXSSVC Cc: EERCEFFYHKZGBMD 
P: GPTJHDHPSETZTCA P: EARLTMTFCIRPMAD 
6 GPTJHDHPSETZTCA 8 EARLTMTFCIRPMAD 
6 HOUIICIOTDUYUBB —-F-Z-8 K-00 _£-5-4-8-0-4+-2-- 
EAH IB HE EE HO) 5 GYTJVKVDEGTNOYF 
ON AEA OB EH! “HE EI IEE OP Se;* ie 
KX FE AEE HAE YE EE -E-W YA EBGE 
bE EEE 3 JVWGYHYAHDWKRVI 
—M5- 4B NEES KU XE GS EOI BHI 
9 NIACOWOIZXASAVH T LTYEAFAYJBYITTK 
4 OHBBPVPHAWBRBUI —M-S-—2Z-—B-B-4-8-X*_K-A- 4+ -0-5--* 
P-G_G-4-@-0-Q-G-B-¥-6_Q-6-F 5 NRACCDCWLZAGVRM 
-Q-F-B-Z-R-F- RE HPS 2 OQBBDCDVMYBFWQN 
12 REEYSSSEDTEOERL 6 PPCAEBEUNXCEXPO 
7 SDFXTRTDESFNFQM 5 QODZFAFTOWDDYOP 
3 TCGWUQUCFRGMGPN RN E-*++4-Z-G-S PVE 6-2 | 
2 UBHVVPVBGQHLHOO 4 SMFXHYHRQUFBAMR 
T VAIUWOWAHPIKINP 7 TLGWIXIQRTGABLS 
WIENS OI UK HY EPS SH HEE 
KS ARE AH KE —Y—d- EU KK - ERED HE 
YE X-E-R-4 Eb 4 XMM EH LH*ES- WEE LE 8 EE 
—Z—-W-M-Q-A-K-AC WEE HG I CES —*-#H-K-S—-M-E MM YP KK HEF-H i 
5 AVNPBJBVMKNFNIU 59 YGLRNSNLWOLVGGX 
T BUQOOCICUNJOEOHV 7 M-Q-0-R-6-# XH EE 
5 CTPNDHDTOIPDPGW AE N-P—P—Q PI EM NCE-E-E-4—- 


—B-S—Q 44 E-G_-E-S-P_4-Q-6 QF 

T ERRLFFFRQGRBREY 6 CC PNRORHAKPRKCB 

—-Q-S-+64-E-G-Q 2 S A-+3S_B A —B-B—Q-4-S-4-S—G-B-#4-2-4- BE 
Figure 47a Figure 47) 


5 Generatrices with three or more of the letters JKQXZ have been eliminated. 
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The R generatrix of the letters of column 1 (with a two-category score of 12), and the E generatrix of 
column 2 (with a score of 8) are clearly the correct ones, and the solution is off to a flying start. 

g. In the decipherment step of the preceding subparagraph, the base letter was correctly assumed to 
be A,. Had we assumed an incorrect base letter, for example Dp, our steps would have been those shown 
below: 


Column 1 Column 2 
K: AJ PWIKDKPVEWZWC K: AHAULWMWFFIUPPA 
C:GVICQKKWHWXSSVC Cc: BERCEFFYHKZGBMD 
P: JPWJIKDKPVEWZWCD P:HAULWMWFFIUPPAG 
GP BP AE EB 3 HAUOWMHH)FOuUPP@S G3 
KOXEL6E OF DX ¥EBE- EZVEXREXECHYOQZH 
SLNYHMBMNXCYXYAFG@/3 -F¥WTYKYDHCHNRYT 
—MMEZ-G-N-ANM-¥ BZ 2 OG KEXEZSTSCEF EMS HE 


TNLAFOZOLZAAVAYHE1 SLWYHATABJEYLTWK3S 


NoODN 
oOvoz 
Anya 
VADP 
Qt 
QoQ 
OU FIA © 
NmAOQ 
=ay6KN 
o2zsar 
NYrwa 
VAWP 
QOH 
KM as 
Anca 
Voz: 
PANN 
a nu 


TRH®BSVSOHOWHRO)uL).e 1 
6SGFATUTGEVFQFTM42 

4TFGZUTUFFUGPGSN22 -RQEBGCEGVPYEFZOQ 
TUMHOVEVOEMHOH®MO16 SSPFAHBHUQXFEAPR32 
6VDIXWRWDHSINIQP33 O9TOGZIAITRWGDBOS54 
—W-E-G- WOKE ROEM PQ -UNH-ES ZS S VHC EN EB 

KX BKVY PY BQH EKO R- VME RP UE B-D-MY- 
Yh O20 AK PEE NES WHEE WE XLQU To AED HE 
2-2 MAT-AN A ZL GM AE KK MM BROS KEP 
TAYNSBMBYMNNINLU43 —-¥d#5UN¥NOPRLYGERK 
—B-X-0-R-G-L-6-K-N-ME OH —Z—E-M-B-O-0-0 NEO HE 
—C-HP-QDK-D-O LP PE 6AHNSPTPMYPNWIHZ42 
BV QPEDEV-PKQF-Q EX- BORG S-GLZO9 VU GA 
—E4-R-O-F-E-F-U-9-d-R-E-R-H- —OFP-QRRRK AN PH FB 
BFTSNGHGTRISDSGZ44 -DEQPSQSIBMQTLEC- 
7GSTMHGHSSHTCTFAS52 8®DROMPMIOL®sMdOS 3 
6HRULIFIRTGUBUEB33 7FCSNUOUHDKSRNCE43 
—E-Q4V KS EQ HAD S5GBTMVNVGEJTQOBF41 

Figure 48a FiGuRE 486 


The numbers to the left of the generatrices give the two-category score for the generatrix as a whole, while 
the numbers to the right give the two-category scores for the odd and even letters, respectively. It may 
be seen that the correct generatrices are those with the ringed letters, and that from the intervals between 
them the base letter must have been not D,, but three letters earlier, or Ay. 
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h. If the message in subpar. b had been enciphered with the same introductory key, PARLIAMENT, 
but with reciprocal alphabets (e.g., reversed staadard), the only way we could have arrived at the 
length of the introductory key is by trial and error, since the technique demonstrated in subpar. d does 
not apply. We would have had to make generatrix diagrams for the first several columns of trial widths, 
until a solution was reached. In Fig. 49a, below, is the autokey decipherment of the letters of column 1 
obtained from a write-out of the cipher text on a width of 10, together with the appertaining generatrix 
diagram, on the assumption of reversed standard alphabets; the correct plain text comes out on a gen- 
eratrix which has been underlined. In Fig. 495 we have the decipherment of the letters of column 1, 
under the incorrect assumption of the base letter as D,. Note that the correct letters are those ringed, 
in an ascending diagonal pattern. This demonstrates the messiness of the case of plaintext autokey 
encipherment with reversed sequences, an unknown length of introductory key, and an unknown base 
letter. 


Bre 

WENKMESCHUIDOVOZEOCRUHTANAVA alLK> 
OZEPRUVHTAWNMOAOUENKKX aS CHHAWOV VzZA 
OZZPRUVHTAWNMONWePNKhM ES CHHNWOV Vir 'v 
HIAWHUAQWPNK KM EK CHHNWMOVOZEr RG alow 
QUPNK MES CHNMOVOZEORGHTAAMO UlaG 
QUPNK MSEC CHINDMOVOZEOCRUHTAAMO UbPU 
QWENKM AS CHNDOVOZEOCRGHTAAHYU UPY 
OZEZORGHTAMNMOAWE NX MES CHHAWOV vloU 
ZECORGHEAQUHDAWENKKM SEK CHHNDMOVO Olw'd 
VAWPEPNKM SES CWHNDOVOZEPRUHTAANM BO 
OZEZOCRGHTADMNMOAWENKxM EM CHHAWoOV vile 
HM BSCHNMOVOZEZOCORWGHIAAMTAWEN Niov 
OCZEMVPARUHTAWNMONQWeNKKM SS CHNAWOV VAN 
WDEPNK MES CHUIWOVOZEOCRUHTAINMIAQ alzv 
<CHNWOVOZEIPRGHTAAMVAWENKMS alana 
ye 

HOQW PNK MES CHUN@ovlsezerRoHras aKS 
CHUMOVOZEPRGHTA WA AWeNKM ES SZ 
MSS CHNMWOVOZEORGHTANAW®MVAWe NK KP < 
CHNMAOVOAZEZORGHENIMOAWENOxec <laK 
DOVOZZORGHTAAWAUIAWENKhM SETI CH® uia< 
GHOQMOVOZZORGHTAAMITAWENKM SS <b DH 
KS SBSCH@QMOVOZECPAGUHTAUAMOAWENK Kh < 
ZC RUHTANVW@vAWEeNKM SEK CHHNWOVOZ zlox 
CZECAUHDTAADAOQAWE NK MEK CHHWOV viz 
TQAMOQAWPENK KR ES COQHNMWOVO ZEEE AGH Hi 
SGCHNWOVOZErPRUHTANAIAWENKMS BlUH 
HIQNNUAWDEPNKKMEKCCHNDMWOVOZEORU ozs 
@va aka 
OVOAEZORWVHTNMAMAIAWENK MEK GCHNHN NnIza 
CZEFORGHTOAAMVAWENKM ES CHHNWOV whan 


Wren HS SCHNDWOVUEI SZ EOARGHIL|AA 


@ 


FiaureE 49a Figure 49b 


1. When the plain and cipher components are two different sequences, not only must we arrive at 
the correct length of the introductory key by trial and error, but each base letter must be laboriously 
assumed in turn for the specialized generatrix diagrams (cf. those in subpar. 30m) pertaining to each 
assumption of introductory key length, since the correct plaintext letters cannot be determined from 
any sort of systematic pattern from the generatrix diagram predicated on an incorrect assumption of 
the base letter. 

j. In subpar. e it was stated that the aperiodic substitution resulting from plaintext autokey en- 
cipherment can be converted to periodic terms and solved as though it were a repeating-key cipher, 
provided that the primary components are known sequences. As a demonstration, we shall use as an 
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example the cipher text of the message in subpar. 6 which was discovered to have been enciphered with 
an introductory key of 10 letters. This cipher text, written on a width of 10, is reproduced in Fig. 50, 


below: 
1243 4 
(1) GETP 
(2) VEXC 
{3) I RTD 
(4) CCC K 
(5) QESU 
(6) KF OH 
(7) KF RG 
(8) WY KT 
(9) HHHS 
(10) WK BT 
(ll) XZLZ 
(12) SGPX 
(15) SBVR 
(14) VMXV 
(15) CDIW 
Figure 


HRS ywBW<s NOX SW BHES 


7 8 9 10 
URTA | (1) 
BVRS | (2) 
XWYX 
POAW{| (3) 
PMLS 
RSFQ | (4) 
FZVT 
FMOY | (5) 
AMRN 
GBCL | (6) 
KMDE 
WSJV] (7) 
NAGG 
BAWS | (8) 
MWVB 


GETPQVURTA 
VEXCIMBVRS (9) 
paensrheys 
IRTDIIXWYX (10) 
trpqqrgqsaf 
CCCKBWPOAW (lil) 
jilinulfazgwar 
QESUXSPMLS (12) 
htfamnqgqlb 
KFOHWVRSFQ (13) 
dmjhkibcup 
KFRGGXFZVT (14) 
htizwpexbe 
WYKTFODFMOY (15) 
pfcujobpnu 
Fievure 51 





AN [MN c+} © [Sw [T's 

WSN INeY (Xo tres 

HOP <[< oO Puo'v lie = lwHimo 
Nix 1S [wtb O IN 4 [HS IM & 


a aI + 
Ools 8 





PZ DIO TlWAWPodir nia rine 
EIS OS UIs IWOals xi olno 
HIE ie se ia ctl OR lO N > oO 
BS Wie 0 [> WIM eI oO lo M [= 'd 
vic cla ola oaluniodlaolms 
em in KX IONCM Bik vnlie tla 


Q 


9 
oa 


Now using the assumed components of direct standard alphabets,® we will treat the first row of cipher 
text as key elements with which to decipher the second row, and this resultant “plain text’’ will then be 
used as key with which to decipher the third row, and so on through the 15th row. This step is shown 
in Fig. 51, above. We now write the first 10 letters of the cipher text, and all the subsequent ‘‘decipher- 
ments” of Fig. 51, into the rows of a rectangle of a width twice the length of the introductory key; this is 
shown in Fig. 52a, below. The original aperiodic cipher text has now been converted into periodic poly- 
alphabetic substitution, as can be proved by a comparison with the original plain text written on a width 
of 20, as shown in Fig. 526. The monoalphabetic columns of Fig. 52a can now be solved by the generatrix 
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QxeRAM WAP s 
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Figure 526 
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IAI Ie OQ SRI 
IG Efe SIG > IK 


% 
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6 We know that the plain and cipher components must be identical sequences running in the same direction, otherwise 
the length of the introductory key could not have been discovered by the method employed in subpar. d. 
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method, using direct standard alphabets which we have just proved to have been employed by the 
enciphering cryptographer. 

k. The mystery of the conversion of a plaintext autokey encipherment to periodic terms will now be 
explained. First, let the key word PARLIAMENT be enciphered by the following alphabet: 


13 14 15 16 17 18 19 20 21 22 2 2% 25 
STUVWXYZ 
IHGFEDCB 


10 11 


8 
P: A 
Cc: A 


Nw ~ 
Kae 
xOe 


4 
E 
W 


<5 ° 


6 
G 
U 


Hot 


8 9 12 
IJ M 
SR 0 
PA I 


A OR 
cr wr 


P: 
Cc: LAJ PS 


aa RO 


rr 224 
ox FO 
42h rv 
nea 


Then let the message RECEIVING HEAVY ARTILLERY FIRE . . . be enciphered by direct standard 
alphabets as before, but for the key add the monoalphabetic equivalents of PARLIAMENT (i.e., 
LAJPSAOWNH) to the key itself; that is, use the 20-letter key sequence PARLIAMENTLAJPSAOWNH in a 
repeating-key manner, as shown in the figure below: 


12 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 2% 
K: PARLIAMENTLAJPSAOWNH 
P:- RECEIVINGHEAVYARTILL 
C: GETPQVURTAPAENSRHEYS 
P: ERYFIREONMYLEFTFLANK 
C: TRPQQRQSAFJLNULFZWAR 

Figure 53 


The cipher resultants of this process of enciphering a message coincide exactly with those obtained from 
the deciphering operation that gave rise to Fig. 52a. How does this happen? 

(1) First, let it be noted that the sequence LAJPSAOWNH which forms the second half of the key for 
enciphering the text in Fig. 53 may be described as the standard-alphabet complement of the sequence 
PARLIAMENT which forms the first half of the key. Arithmetically, the sum of a letter of the first half 
and its corresponding letter in the second half is $, mod 26. Thus: 


P+L=15+11 = 26=9 
A+A= 0+ G= G 

R+J=17+ 9=26=4 
L+P=11+15=26=9 
I+S= 8+18 = 26=9 


In other words, the LAJPSAOWNH sequence is, by cryptographic arithmetic, equivalent to ‘minus 

PARLIAMENT.” Therefore, in Fig. 53, enciphering the second half of each line by the key letters 

LAJPSAOWNH (ie., adding 11, 9, 9, 15, 18 . . .) is the same as deciphering by the key letters 

PARLIAMENT (i.e., subtracting 15, $, 17, 11, 8. . .). For example, at position 11 of Fig. 53, Ep(Lx) = 

4+11=15=P,, but if we use the key letter at position 1 and subtract it from E,, we have E,(—P,)= 
4—15=4—15+ (26) =15=P,, the same cipher resultant. 

(2) Refer now to Fig. 52a. The letters in the first half of line 1, beginning GETPQ . ._ ., are identical 
with those in the first half of line 1 of Fig. 53. They must be identical because they are produced from 
identical elements. The letters in the second half of this same line in Fig. 52a, beginning PAENS . . ., 
were produced by deciphering the letters in the second line of Fig. 50 (VEXCI . . .). Thus (taking for 
illustrative purposes only the first five letters in each case) : 


PAENS = VEXCI —- GETPQ. 
But VEXCI = EAVYA + RECEI 
and GETPQ = RECEI + PARLI. 
Hence, PAENS = (EAVYA + RECEI) — (RECEI + PARLI), 
or PAENS = EAVYA — PARLI. {T] 
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As for the letters in the second half of line 1 of Fig. 53, also beginning PAENS . . ., these letters were 
the result of enctphering EAVYA by LAJPS. Thus: 


PAENS = EAVYA + LAJPS. 


But it has been shown in subpar. (1), above, that 


LAJPS = — PARLI. 
Hence, PAENS = EAVYA + (-PARLI), 
or PAENS = EAVYA — PARLI. (IT} 


Thus, equations [I] and [II] turn out to be identical but arise from what appear to be quite diverse 
sources. “ 

(3) What has been demonstrated in connection with the letters in line 1 of Figs. 52a and 53 also 
holds true for the letters in the other lines of those two figures, and it is not necessary to repeat the 
explanation. The steps show that the originally aperiodic, autokey cipher has been converted, through a 
knowledge of the primary components, into a repeating-key cipher with a period twice the length of the 
introductory key. The message may now be solved as an ordinary repeating-key cipher. 

l, The procedure just described (in subpars. 7 and k) has the advantage over the generatrix methods 
of subpars. g and f in that it is not necessary to assume the correct base letter for the procedure to work. 

m. The foregoing case is based upon encipherment by the normal Vigenére equations 6j2=6); 
6o1=8¢;2. When encipherment has been accomplished by the equations 6, ;,2=6;n ; 0p2=@en, the conversion 
of a plaintext autokeyed cipher yields a repeating-key cipher with a period equal to the length of the 
introductory key. In this conversion the equations 0, 2=6\n; 6pn=6e/2 are used in finding equivalents. As 
an example, note the plaintext autokey encipherment of the following message by equations 6,,.=6,;; 


Onj2=9on: 

K: TUESDAYINFORMATIONFROMRELIABLESOURC 
P: INFORMATIONFROMRELIABLESOURCESINDIC. 
Cc: PTBWOMCLVJZOFOTJQYDJIJINZNODMRBTOQZJIRA 


If the cipher text is written out in lines corresponding to the length of the introductory key, and each 
line is enciphered by the one directly above it, using the normal Vigenére equations in finding equivalents, 
the results are shown in Fig. 54). But if the same is enciphered by equations @,2=61)'; 0p2=8en, using 
the word TUESDAY as a repeating key, the cipher text (Fig. 54c) is identical with that obtained in Fig. 
546 by enciphering each successive line with the line above. 




















Original cipher Original cipher Repeating key 
text and converted encipherment 
text 
TUESDAY 
INFORMA 
PTBWOMC PTBWOMC +«—— PTBWOMC 
LVJZOFO LVJZOFQO 
TIONFRO 
aokverq+*—"AOKVCRQ 
TIJIQYDJIN&« TJQYDJIWN 
MRELIAB 
txatfad TXATFA 
ZNODMRB ZNODMRB 
LESOURC 
skowrre+————"S KOWRRE 
TOQZdJRA+s>———-~ TOQZJRA 
ESINDIC 
lyevaie -~LYEVATIE 


(a) (b) (e) 


Figure 54 
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Now note that the sequences joined by the arrows in Figs. 54 and c are identical; since it is certain that 
Fig. 54¢ is periodic in form because it was enciphered by the repeating-key method, it follows that Fig. 
546 is now also in periodic form, and in that form the message could be solved as though it were a repeat- 
ing-key cipher. 

n. In the case of primary components consisting of reversed standard alphabets, the process of 
converting the plaintext autokeyed text to periodic terms is accomplished by using a direct standard 
alphabet and ‘‘deciphering” each line of the text (as transcribed in period-lengths) by the line above it. 
For example, here is a message enciphered by reversed standard alphabets, with the initial key word 
TUESDAY: 


K: TUESDAYINFORMATIONFROMRELIABLESOURC 
P: INFORMATIONFROMRELIABLESOURCESINDIC. 
Cc: LHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJIA 


The cipher text is transcribed in periods equal] to the length of the initial key word (7 letters) and the 2d 
line is ‘‘deciphered” with key letters of the Ist line, using the normal Vigenére equations 6,,2.=6,n; 
Onn=Oe. The resultant letters are then used as key letters to ‘‘decipher’’ the 3d line of text, and so on. 
The results are as seen in Fig. 556 below. Now let the original message be enciphered as a repeating-key 
cipher by reversed standard alphabets with the key word TUESDAY; the result is shown in Fig. 55c. Note 
that the odd or alternate lines of Fig. 556 and c are identical, showing that the autokeyed text has been 
converted into repeating-key cipher text. 


Original cipher Original cipher and Repeating key 
text converted text encipherment 
TUESDAY 
INFORMA 
LHZEMO Y -—~LHZEM 0 ¥ -——_~ LH ZEMOY 
PF RBM VM -—~ PFRBMVM 
TIONFRO 
amqfyjk+— “AMQFYJK 
HR KC X RN + HR KK CX RN 
MRELIAB 
hdahvax+———~HDAHVAX 
BNMXOJZ+——~BNMX0JZ 
LESOURC 
iqmejjwt*#—"IQMEJJIW 
HMKBRJ A+——HMKBRJA 
ESINDIC 
‘ pPcwfas ws ~PCWFASW 
(a) (b) (c) 


Figure 55 


o. The foregoing procedures indicate a simple method of solving plaintext autokey ciphers when 
the primary components or the secondary cipher alphabets are known. It consists in assuming intro- 
ductory keys of various lengths, converting the cipher text into repeating-key form, and then examining 
the resulting diagrams for repetitions. When a correct key length is assumed, repetitions will be as 
numerous as should be expected in ciphers of the repeating-key class; incorrect assumptions for key 
length will not show so many repetitions.’ All of the foregoing presupposes a knowledge of the cipher 
alphabets involved. When these are unknown, recourse must be had to first principles, and the messages 


7 These repetitions need not be polygraphic repetitions in order to prove the key length. In the write-outs on the 
correct width, the average I.C. of the entire array of columns should be near 1.73, with acceptable deviations. See in this 
connection subpars. 18¢ ef seg. in Military Cryptanalytics, Part IT. 


SECRET 96 





—SEGRET- 


must be solved purely upon the bases of probable words and repetitions; the general approaches will be 
demonstrated. 

32. Analysis of a case involving unknown components.—a. When the primary components in a 
plaintext autokey system are unknown, the observations noted under the preceding paragraphs are, of 
course, not applicable; nevertheless, solution is not difficult. Let us assume that we have available the 
following three cryptograms, all intercepted on the same day, and therefore suspected of being related. 


Message No. 1 





HUFII OCQJJ IVZ0ZVPDGO VVVKW UEWHU 
UQHUM RZVQR UAKVD NNEZV GJPGH AYJDR, 
UWNGR YSKBL QVUXN PHDPR SVKZP PPKGS 
LLPRV RBHAK WUAVW YUEZQ XAPQY GPSVS 
FNRAK CIFGZ UVCCP DKCWV XTWFM RFKBV 
ROQOJ DRUWN GRYSK BL 

Message No. 2 
JUFII OCQJJ IVZ0ZiIBFEJ SUBRJ SPKTS 
RZVXT WFMRF QHHFO RFJPD GOVVV KWUHE, 
NDBDD RHWUN KCMPD GOVZS ENDBD DRHWPU, 
WNPPKP EQOY 

Message No. 3 
FJUHF FKDEN ALUPZ KQMVB JWVPK EUBODD, 
RHWUM RHVGP DNCUJ CDZCY RHUJU FZPQP 
YQCYH OEQZV XKCQF TVHNS VCCEJ PEAMP 
APOEP BHMVJ UNMHH WKCVG@ DSWJU EQZBQO 
FFYUE ZQXAP QYGPA RPZVX CFNRA KCIFG, 
Z2UVCC PDKCO GJWZH APUFZ FVHAV XMHFF 
KMYHS TBSKC VRQIJ YCPZH UHCBM THOFH 


b. There are many repetitions within and between the messages, attesting to their cryptographic 
homogeneity. The intervals between repetitions show no common factor, and the 6 I.C. of the composite 
uniliteral frequency distribution is 1.12; these manifestations admit of the possibility of a plaintext 
autokey system. Furthermore, the appearance of the repetitions in the first line of Message No. 1, with 
the isolated Ist and 16th letters, suggests a 1-letter introductory key. 

c. The simplest assumption to make is that Vigenére encipherment with standard alphabets is 
involved ; however, the trials both for direct standard and reversed standard alphabets are unsuccessful.® 
We next assume that the plain component is the normal sequence, the cipher component a mixed se- 
quence. The various repetitions are studied intensively, in particular the 13-letter repetition 
JDRUWNGRYSKBL and the 10-letter repetition PDGOVVVKWU, which, on the hypothesis of a 1-letter 
introductory key, must represent 14-letter and 11-letter plaintext sequences or words. 

d. If the normal Vigenére method of encipherment is in effect, then the base letter is probably A,, 
in which case a good word to fit the 13-letter repetition is 


K: . RE C(O\NNATSSAN 
P: RECOININATSSANC 
U RYS KB 


C: JDRUWNG 


E 


rea 


8 The theoretical I.C. for plaintext autokey systems involving either direct or reversed standard alphabets has been 
computed and found to be 1.035; this then would tend to disprove the assumption of standard alphabets in the case under 
examination. 
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and a good word to fit the 10-letter repetition (note the corroborative vertical trigraph ONU with the 
preceding crib) is 


K: .OBSERVAT I{O)N 
P: OBSERVATIO 
C PDGOVVVKW 


e. The values from these two assumptions are inserted in a reconstruction matrix, yielding the 


following: 
Plain 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 





Key 





NK HSS CHNAOVOABROCAGCHITONAHBVIAD YS 











Figure 56a 
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On the hypothesis of direct symmetry of position, we are able to amalgamate the values in the square 
into a nearly complete sequence, as shown by the fragmentary matrix below (the derived letters are in 
lower case) : 




















Plain 
ABCDEFGHIJKLMNOPQRSTUVWXY2Z 
Ajadjus/itinGbjic Kl op Viw y re 
Bib c 1 op |vw re Djjfu in 
Cle L| op viw Rje dju in b 
Did 
E\e D 0 
Fif 
Gig 
H/h W R 
Tli 
Jj 
K/k 
L}1 

Key M{m 
NIN B W 
Ojo P U 
P/p 
Q\a 
Rjr J Vv 
s|s G Y 
at K 
Uju 
Viv 
Wiw 
X|x 
Y\y 
Z\Z 
Figure 56b 


The keyword-mixed sequence is apparent, and the original components must be the following: 


P: AB 


CDEFGHIJKLMNOPQRSTUVWXYZ 
Cc; READ 


JUSTINGBCFHKLMOPQVWXYZ 


With the primary components at hand, solution of the messages is now a trivial matter. The messages 
are found to have initial keys of R, L, and W, respectively. 

jf. The foregoing example used an unknown mixed cipher component sliding against what was first 
assumed (and later proved) to be the normal sequence. When both primary components are unknown 
mixed sequences but are identical, solution is more difficult, naturally, because the results of assuming 
values for repetitions cannot be proved and established so quickly as in the foregoing example; if the 
primary components are two different unknown mixed sequences, the problem becomes even more 
difficult. Nevertheless, the general method indicated, and the application of the principles of indirect 
symmetry of position will lead to solution, if there is an adequate amount of text available for study. 
When the introductory key consists of several letters, repetitions are much reduced and the difficulty 
of solution is considerable but by no means insurmountable. Under operational conditions, the inevitable 
cribs, collateral information, isologs, and compromised plain text, make analysis even of difficult plain- 
text autokey systems practicable. 
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34. Analysis of digital plaintext autokey systems.—a. In digital plaintext autokey systems wherein 
the nature of the intermediate text is known, the methods of solution are identical with those of literal 
plaintext autokey systems involving known components. As an illustration, let us assume that it is 
known that the enemy is using plaintext autokey systems with one-digit introductory keys, in conjunc- 
tion with the following variant matrix for producing the intermediate text: 


OOON ®D 

OO KWD 

<oOra |e 
SAME Q0\0v 
aNADAIN 
wWHOH UIA 
NG vs wo 


The encipherment of the word REGIMENTAL, for example, could then take on the following form: 


R EGtIM™ENTAL 
47 15 22 79 82 60 33 94 16 81 


This intermediate text, when subjected to additive encipherment by the plaintext autokey method with 
the introductory key 4, would yield the following cipher text: 


K:44715227982603394168 
P? 47152279826033941681 
Cc: 81867496708 636235749 


Now if a message beginning with the groups 81867 49670 86362 35749 . . . were intercepted, the 
simplest procedure would be to make a trial ‘“‘decipherment,” and then complete the plain-component 
sequence down the columns in alternate directions. First, the “decipherment” with an arbitrary key of @: 


K: oe ee 
Cc: 8186749670863 6235749. 
BS5l68152806793 05227 

Next, in Fig. 59, below, we show this decipherment, together with the generatrices formed from this 
first decipherment by running down the normal numerical sequence in the odd columns, and down the 
reversed normal sequence in the even columns; the generatrix marked with an asterisk is the original 
plain text, which will decipher as “REGIMENTAL” with the known matrix. 


8 


bh 
o 
© 


K: 
C: 
P 


* 


NOOIAWNWEH OO O1M O 
AAONWOOKHN We 

AANMH OO OND MN/IO Ww 
YVaAARAIAHNDWODOrKID A 
AbhAandroOOAAN ODN 

OANDWDWOOKrRPNAA ODF 
FOODOANODAAA NING 
DOOrRPNAARADN WOW 
ODANODAAWANE OM © 
NOOOrNWAAHDIN © 
Oak AMF OO WO NIN DD 
COPNWAAATDNA OID AN 


22 
49 
27 
36 
45 
5 4 
6 3 
72 
81 
9 0 
09 
18 


OCOOKrFNAAADN OA 
COON ODAA ANE IO 


Figur: 59 


1 Since additive encipherment is really a digital Vigenére system with direct standard (numerical) alphabets, the 
cryptanalytic treatment must be identical to that of its literal counterpart. (See also subpar. 35g on subtractive and 
minuend methods.) . 
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b. If the general nature of the intermediate text is known but the introductory key consists of an 
unknown number of digits, generatrix diagrams (similar to those employed in the analysis of literal 
plaintext autokey systems) for the various possibilities of key lengths would enable the cryptanalyst 


9481276503 





to effect a speedy solution. As an example, let us suppose we know that the enemy is using the monome- 
dinome matrix shown above for his intermediate text, in conjunction with additive-enciphered plaintext 
autokey and introductory keys of varying lengths, and that the following cryptogram is at hand: 


04166 94503 96343 36243 94770 44813 
$5073 48890 04265 64839 23734 94333 
48934 08301 25077 74005 46288 92134 
84311 55035 


Assumptions of introductory key-lengths of 1, 2, 3, and 4 are tried, without success. On assuming a 
trial length of 5, we take every fifth digit of the cipher text, starting with the first, and subject these 
digits to a plaintext autokey decipherment with, say, an arbitrary initial key digit of @. From these 
“decipherments” we complete the plain-component sequence down the columns in alternate directions, 
as shown in Fig. 60a, below: 


12 3 4 5 6 7 8 Q9 10 11 12 138 14 15 16 17 18 19 
K:00903685915722843180 
C:0993943 4062940274985 
P:09036859157228431805 

18127768248137522714 

27218677339046613623 

36309586420955704532 

45490495511864895441 

54581304602773986350 

63672213793682077269 

72763122884591168178 

81854031975400259087 

90945940066319340996 


Ficurer 60a 


Since it is difficult to recognize ‘‘plain text’’ when we have it, we shall have to resort to statistical recog- 
nition and weight the generatrices, using the following log weights computed for the intermediate text 
produced by this particular monome-dinome matrix: * 


Plaintext digit: 0 123456789 
Log weight:9118713055 


138 The computation of these log weights is shown in subpars. 876 and ¢ (on pp. 246-248) of Military Cryptanalytics, 
Part I. 
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The generatrices of the diagram of Fig. 


ATIONHFNOrFEHO = 
OFRPKrORFNOMO w 
ATIoONdrAIOrFrO ow 
NerRQOUgaOorreH am 
PNIOrRrFOUNUMOWN « 
AOrrOANRrFWNOU o@ 
NOrrouanowr «~ 
OrFrFOaANHFAOUU ow 
ONNONRKYFNOEHE: o 


The last generatrix, with a high score 


60a, when scored by the foregoing weights, become the following: 


10 11 12 13 14 «15 16 


- 
oe 


18 19 20 


WoaunarrwANr 
AQrETIOrFrFOUUMO 
OnNrNAoai;orr 
FOMNNAOArHNAN OF 
OOrFrONRrFAOUM 
MOrrFOUUMOWE A 
NIrPaoanorr eo 
ONAOWNKHNIORF 
NQorraNrWoOUW 
aaondrenN Orr © 
Qoandoerronr 


Figure’ 60) 


of 114, shows us that we have arrived at the correct length of 


introductory key, and that this generatrix is the correct one. Similarly, the correct generatrices for the 
remaining four positions yield high scores of 124, 135, 1385, and 130, and we have discovered thereby 
that the first five plaintext digits are 94503, making the introductory key 10663. The decipherment of 
the beginning of the message is shown below: 


QID ao 
olo o 
Oj A 
ofa a 
alo Oo 
OlW ws 


K: 
C: 
P 


Dolor 
EP ALA O 
Q ofr oO 

O10) Oo 


Oo N N A 


0 
9 
9 


ho 
WOs 
w oO 
Oo) O) 
nm 
ob 
wo 8 
On 

3 


mala o 
~y oly © 
ralo 

loo 
Om oO 
Oj: b 
O{o@ © 


WoO 
AIRE N 








Halno 
ca 
Aw 
o 
wh 
°o 
o 
°o 
° 
anu 
oO 
Ain Os 


s S A A N S 


c. For the next example we shall consider the case of a digital plaintext autokey system involving a 
1-digit introductory key, the intermediate text being of unknown composition. The message is as follows: 


46776 4 


OonN AW 
NoOA NA 
NaOnDOoOU 
aytoonu 
ANwWOoONNA 
oo AO 
NAD OD 
Nob” 


5863 67446 6 7-8-9 7 


ow a 
INDO 
IIAH © 
IOWA 
oorr 
oon oa 
ANNO A 
NON OD 
IA OO 
ADA YD 
nN OO 
pA RRO 


An arbitrary plain text of 0 is assumed for the first cipher digit and the text is deciphered on this basis; 


the first 30 digits are shown deciphered below: 


K; Oo7T7T9 T7989 TT 
C:47466 46776 465 
T 


8-06 
863 
P: O779 7 9897 T8067 


© PAIN NT TIT 
Be //i/ 


nv 
wW 
ih 


z 
z 
z 
z 
z 
z 
z 
z 
8 


Ou NI] 

OD HAL TAL THI 

SU DAL TAU TATU PUP HII 
CO PHL PAY TRU TA NE TAAL DE TIT 
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. 10(4726) 
The 6 I.C. is 160X159 
of the other possible decipherments in order to be able to evaluate its significance. 

d. The first 30 digits of the next four decipherments, on the basis of plaintext 1, 2, 3, and 4 for 
the first cipher digit, are shown in Fig. 61, below, ® followed by their appertaining distributions: 


=1.89, a high figure, certainly,“ but one which must be compared with the I.C.’s 


K: 1688 86070 68715 88959 70588 06172 
C: 47466 46776 45863 67446 75368 67897. 
P:@6888 60706 87158 89597 05880 61725 
* © & E F 
K: 2597 9516159624 97040 61497 15263 
C:47466 46776 45863 67446 75368 67897. 
P:(2)5979 5161596249 70406 14971 52634 
x & & Ke 
K: 3406 04252 40533 0613152306 24354 
Cc: 47466 46776 45863 67446 75368 67897 
P:@)4060 4252405330 61315 23062 43543 
* %&* & He 
K: 431513343 31442 1522243215 33445 
C: 47466 46776 45863 67446 75368 67897. 
P:@)3 15 3343314421 52224356215 34452 
Figure 61 
eee , 
z Sz z = 
ZS = 2B. ~ ZS = =z = 
Zz ~ 22222 222 22ZZZS z 
zz 222 BZBAZ Z2Z2Z2Z2ZZZ Z 
Z2ZS ZZREZZZ 22222222 2 
0123456789 0123456789 
Base 1 6=1.25 Base 2 6=1.11 
2 = 
z5 ~ Zz 
Zz = 222 
ZZ _S8 2222 
=. #2 ZB 2222s 
2222225 22222 
2222 ZZZ 22222 
2222222 22222 
0123456789 0123456789 
Base 3 6=1.56 Base 4 6=2.12 


14 If we had bothered to take an J.C. of the over-all cipher text, we would have found it to be 1.81; therefore the 
figure of 1.89 hardly reflects anything rougher than the original ciphertext population. 

18 Note that it would be simpler to generate the next four decipherments by means of a generatrix diagram such as 
that shown in Fig. 59; the example here is for the purpose of pedagogical clarity. 
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e. If we had made five more decipherments on the basis of plaintext digits 5, 6,'7, 8, and 9 as the 
equivalents for the first cipher digit, we would have obtained the following distributions: 


Z= 
=z2 
ZzZ=z = 
zzz =S2 = 
ZZzZs = #225 
~ Z£Z222 ZzZZZRZZEZ -< 
=X FZZAZ ZZFZZTZZZ = 
ZZ ZZ ZZzS 2 ZFZZZZZS = 
0123456789 0123456789 
Base 5 6=1.89 Base 6 6==1.25 
= z 
=z ~ Zs 
ZZ = ZBBZBZZZ 
222 Z2ZXRZAXZZ 
Z22F ZHTZZZEZ 
O1l23 456789 
Base 7 6~1.11 - 
x zz 
ZS ~ 22 
zz = ZzZzZ 
3 Zz ZzZzZz 
z = ~#zZ2 = zz zz 
ZS Z=ZZzZZ z ZZ ZZ 
zz = 2ZzZzZzZ = ZX ZZ 
zz z#2z2ZZ z ZzzZz22 
0123456789 O1l1l23 456789 
Base 8 5=1.56 Base 9 6=2.12 


Note that the distribution for base 5 is identical with that of base 0, except for a slide of 5; the distri- 
bution for base 6 is identical with that of base 1 (except for the slide of 5), and so on to the distribution 
for base 9 which is identical with that of base 4, with a slide of 5.° This means that we may dispense 
with the last 5 decipherments, since we can derive their distributions artificially from the first 5 distri- 
butions. 

jf. The greatest roughness is displayed by the distributions based on 4 or 9 as the initial plaintext 
digit; the problem may now be solved on either base, but the initial plaintext 4 seems, from the limitation 
of the span of digits 1-5, the more likely base. A dinomic distribution is made of the intermediate text, 
and it is quickly discovered that it is produced by a 5 x 5 square containing the normal sequence (I=J), 
with the digits 1 through 5 in normal order as the coordinates;" the first two words are found to read 
“SECOND REGIMENT.” 


16 This phenomenon is a result of the mod-10 arithmetic involved; the explanation can be seen more clearly upon 
examination of rows five apart in Fig. 59. 

17 This is the square employed in the classic Nihilist system (cf. par. 81 of Military Cryptanalytics, Part II); the fact 
that we were faced with a Nihilist system could have been surmised from the distributional appearance of the original 
cipher text: 


z 
z 
ZS 
= 22 
= 22 
2 32Z= 
= Zs 222 
Z222Z2ZZE 
S222 RZZZ 
0123456789 
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g. For the last example we shall consider the case of an unknown type of intermediate text coupled 
with an unknown length of introductory key.'® The message under study is given below: 


7 


ROHOIRAIONOWOH 
DONIFOWMDANACAMOA 
NAQAAN TEP HENUNA HR Oh 
DHOAHMCOANHOOAR 
DOrANTOWDHOAHDADY 
SOMOWORUNANONN OO 


3 


NADONNDODANAANAAN 


NHNOWMWDOAGATHLACWODA 
OOONNODAAINNANCOFR A 


ONKFAMDMDODONWNOrRFAUAYO 


AdOrRFOWMDOrRNOAUNTO AN O 
ONMTOMWAODOHLhON DED 


7 


FAONANKRONAAHAOA AO 


OWNRONNAWDOWAAWAEH 


6 4480 
0 4001 
11714 
3 8311 
4 3872 
T4804 
0 2373 
7 6310 
4 8067 
0 9667 
8 5795 
78040 
3 8336 


RONIIOROPPRO TH 


ArPWMDOrRNOOAONNA O 
NINDWDANONFHF OF AWO 


PR OOMDAANAA AOD 
HONDA AANANARA OO 


EKWANWDOWOMDANEHAD 


NN OFRFROAAWNWNOrF AA 
RODTANARrPNHR OWA 


0 


ANonhododhok nom 


Oh KDWNAANAROrF ODD 


ONNOAMONRANMAABROAICYN 


As in the previous example, we begin by assuming an arbitrary plaintext @ for the first cipher digit, at 
an offset of 1; the decipherment of the first 30 digits and the distribution for the entire decipherment 


are shown below: 


oO & © 
Oh Oo 
“ol @ 


K: 
C: 
P 


Or 

ooo 
oN 
NAO 


eh 
A hr 
DOW 


AO Oo 
ANA 


© DAUD TH TI UII 


nO 
oF Oo 
rPoOoU 


TAY TAU TAY TAL AY PD DEY TT 
0 PH TY TY TTA TTL 


A THI TAL TAY TPCT DDD 


13173 
44801 
31738 

zzz = 

ZzE.= 

ZEzz= 

ZEEE 

ZZzz= 

ZEEE 

ZZz2= 

ZEEE 2 

45678 


OPH THI TAL PHL PE DAY DY IIT 


HOO 
NOr 
Hor 


anr 
eo oO 


OTH 
hoo 
00 ob 
Ob 
On db 


18 The analysis of digital plaintext autokey systems when the length of the introductory key and the properties of 
the underlying plain text are unknown, previously considered impossible, was first published in an article (‘The Analysis 
of Digital Plaintext Autokey Systems’’) by the author in the NSA Technical Journal, Vol. XIV, No. 2 (Spring 1969). 
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h. The 6 1.C. is 403X402. 
tions of 1, 2, 3, and 4 also give I.C.’s hovering near the random expectancy of 1.00. The conjecture is 
made that, at an incorrect offset, the deciphered text will display the I.C. of random, regardless of the 
base of the decipherment. Decipherments on a base of for offsets of 2, 3, 4, and 5 are now made; Fig. 
62, below, shows the ‘‘Ist alphabet’’ of these decipherments: 


=1.01 when § is taken as the equivalent of the first cipher digit; assump- 











































































































K: 0 4 1 2 2 7 3 3 1 9 0 8 8 2 
C: 1 814 4/5 713 4/4 9/9 7/0 116 4/4 8/0 1/9 8/8 6/6 710 8/8 2 . 
P: 0 4 1 2 2 7 3 3 ll 9 0 8 8 2 6 
e+ & He 
K: 0 4 9 0 0 4 6 2 4 
C: 184/45 7/3 44199 7/0 16/44 8/0 1918 B6i/ETO/8 B82. 
P: 0 4 9 0 0 4 6 2 4 4 
* 8 eH * 
K: 0 5 9 1 3 6 0 
C: 1844/5573 44499 7/164 48 01/988 6670 8/82. 
P: 0 5 9 1 3 6 0 8 
a a 
K: 0 7 2 2 7 
C:18 445/73 449/99 7016448 01/9886 6/708 82. 
P: 0 ‘|7 2 2 7 0 
Figure 62 


The digits of these decipherments are allocated into two distributions, a for the digits in the odd posi- 
tions, and @ for the digits in the even positions; thus, for offset 2, above, the digits 01231... are 
tallied into the distribution, while the digits 42739. . . are tallied into the @ distribution.'’® These 
distributions, together with their I.C.’s are shown below: 


a distribution B distribution 
sss = af Ze, ct Sa 
Z222ZS5_2._5 28 ZZSZ 2s 8ZZZ 
2222 2ZZZZZZ ZFZFZSTZZZZZ 

Offset 2; 0 123456789 0123456789 
6=0.98 6=1.00 

= 5. ss = Se 25 = 

Z22ZSSZZZWZZ Z2RZZRSSVSzZ 

Offset 3: 0 23456 89 01234567 8 
6=1.05 6=1.06 

ZSZ2Ze SSSEZ ZB ZFSZSBZSS 

Offset 4:0123456789 0123456789 
6=1.07 5=0.96 

Skis See 25 S2SSs 2 See 

Offset 5: 0123456789 0123456789 
6=0.87 6=0.92 


19 Two distributions, rather than amalgamation into one, are necessary to compensate for the mechanics of the system, 
and to facilitate the establishment of the correct base. 
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’ None of these is significant. But at the very next offset, 6, we have a significant bulge in the I.C.’s for 
_ the decipherment (to the base §) of the ‘‘1st alphabet”’: 














K: 0 3 wk 3 
C: 18445713 4499701644 8/0 1988615670882. 
P: O 3 7 3 3 
a distribution 8 distribution 
= é z = 
ZS=5 55 ZS ~B 2.227 & 
Offset 6: 0123456789 0123456789 
6=1.35 6=2.05 


t. Now we’re getting somewhere. If instead of base § we had made our decipherments on bases of 
1, 2, 3, and 4, we merely would have displaced the a distribution successively one position to the right, 
and the § distribution one position to the left, as is shown below, together with their & I.C.’s: 


a distribution 8 distribution 
z es = = 
= ZS Sst z= ~ = 2.~_z2 = 
Basel: 0123456789 0123456789 §=1.13 
z : = = 
S= Zs Sus = B2.._22 8 
Base2:0123456789 0123456789 &=0.78 
= z = = 
Zex ZS = Sz =... = w8 
Base3:0123 456789 0123456789 &=1.59 
Zen ZS Sze a ES = ~sz2 
Base4:0123 456789 0123456789 &=0.73 


It is evident that base 3 (or 8, which is congruent to 3, mod 5), with a high £I.C. of 1.59, is unquestion- 
ably the correct base for “‘alphabet 1’’; it is immaterial whether we choose the base 3 or 8 as the norm— 
solution may be obtained either way. 
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j. Since we know the correct offset, 6, we now make the a and distributions for the remaining 
“alphabets” on a base of 9, as are shown below: 


a distribution 6 distribution 
~ z = ~ 
2 SSSezFXs 2B Zz s 22. 
Alph.2:0123456789 0123456 89 
= < z = 
ZlLSS 8 FB = SS ZBL 2ZBL 
Alph.3:0123456789 0123456789 
z z = 
me BSEZ. FBS ~Sw.28 25 22 
Alph.4:0123456789 1234567 9 
z “ Ss _ 

Ze. FSS. 88 Z= 2x88 
Alph.5: 012 456789 0123456789 
= 8 =z = z 

zz ZZ. =szZ 3S #Z . 
Alph.6:0 123456789 0123456789 


The é1.C.’s of these distributions on the various bases are shown in the diagram below: 


Base 0 Base 1 Base 2 Base 3 Base 4 
Alph. 2: |0.88 1.05 1.27 0.62 1.41 
Alph. 3: |0.57 1.12 1.17 0.69 1.69 
Alph. 4: |1.43 0.63 1.16 1.01 0.90 
Alph. 5: |1.70 0.63 0.87 0.91 0.91 
Alph. 6: |0.86 1.10 ‘ 1.91 1.05 








From these data it may be inferred that the correct bases for alphabets 2-6 are 4, 4, 0, 0, and 3, re- 
spectively. We can thereupon combine the « and distributions for the correct offsets for each alphabet, 
as displayed below: 


19 4 3 179 2 623 3 
Alph. 1, base3:0123456789 
17. 3 32 it 12 15 8 4 8 
Alph. 2, base 4:0123456789 
20 2 1 18310 2 6 8 4 «6 
Alph. 3, base4:0123456789 
$5 47 7 1 4 10 8 
Alph. 4,base0:0123456789 
22 3 122663 4 6 5 
Alph. 5, base0:0123 456789 
19 2 5 17 18 1 7 3 
Alph. 6, base3:0123456789 


It is now also clear that the distribution for alph. 4 should be shifted 5 positions to be on base 5 (which 
is congruent to 0, mod 5), in order to make it match with the other distributions. When this is done, the 
cumulative total distribution is as follows: 


116 18 12 14 16 31 32 


80 58 14 26 
0123456789 
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10(26,398) 
403-402 
. flect fairly accurately the theoretical I.C. of the underlying intermediate text.” 
k. The first six plaintext digits are 344503 (which we have determined from the bases for the six 
alphabets), so we can reduce the cipher text to monoalphabetic terms, as shown in the beginning frag- 
ment below: 


The I.C. of the combined distributions is =+1.63, which, for this size of sample, would re- 


5 10 15 20 25 30 
K: 840954344503 000494016054003832 
Cc: 1844573 44997016448 0198866708 82. 
P? 344503000 494016054003 832677050 


When the entire text has been reduced to monoalphabetic terms, it is easily diagnosed as a monome- 
dinome cipher, and solution proceeds with alacrity and celerity. The opening words are “SECOND 
REGIMENT” and the monome-dinome matrix is reconstructed as the following: 


9481276503 





As the final step in the solution, the initial key digits 840954 are subjected to scrutiny, and it is discovered 
that the introductory key is based upon the key word PEACE enciphered through the matrix. 

l. The foregoing problem involved what at first blush appeared to be a very complex situation: a 
six-digit introductory key happened to have been used, and it could have been reasoned that, since there 
are 10° different 6-digit numbers, a maximum of 1,000,000 trials”! with the aid of a computer might be 
necessary in order to establish the correct introductory key (if the key length were known). Instead of 
these million trials, however, we had to make only 6 trials to arrive at the correct key-length, and 5 more 
trials to establish the bases for alphabets 2-6. 

85. Concluding remarks on autokey systems.—a. The plaintext autokey systems treated in this 
chapter involved those employing sliding primary components, and therefore having related secondary 
alphabets. As with ciphertext autokey systems, there is no reason why a table of 26 random, unrelated 
alphabets could not be used, such as that illustrated in Fig. 33 on p. 70. The problem of cryptanalysis in 
such a case becomes considerably more difficult, naturally, since we do not have the advantage of the 
exploitation of symmetry of position; nevertheless, as indicated in subpar. 32f, under operational condi- 
tions the inevitable cribs, collateral information, isologs, and compromised plain text make analysis even 
of difficult plaintext autokey systems practicable. 

b. Ciphertext and plaintext autokey systems display characteristics which permit their diagnosis. 
Both cases will show repetitions in the cipher text. In ciphertext autokey systems there will be 
far fewer repetitions than in the original plain text, especially when introductory keys of more than 
one letter in length are employed; in plaintext autokey systems there will be nearly as many repetitions 
in the cipher text as in the original plain text unless long introductory keys are used. In either system the 
repetitions will show no constancy as regards intervals between them. Ciphertext autokey systems may 
be distinguished from plaintext autokey by the appearance of the frequency distribution of the second 
member of sets of two letters separated by the length of the introductory key (see subpar. 23e)—in the 
case of ciphertext autokey these frequency distributions will be monoalphabetic; in plaintext autokey 
systems such frequency distributions will not show monoalphabetic characteristics. Ciphertext autokey 
traffic should be replete with isomorphs; on the other hand, causal isomorphs-cannot occur in plaintext 
autokey systems. 


20 The theoretical y I.C. is in fact 1.63. (See also subpar. 896 on pp. 261-262 of Military Cryptanalytics, Part II.) 
21 Actually, only 999,990 trials, since we exclude the ten trivial cases wherein al] the key digits are identical. This 
results in cutting down the work by a factor of one one-hundred-thousandth. 
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c. Whereas the expected I.C. of ciphertext autokey traffic is 1.00 (.e., random), the I.C. of plaintext 
autokey will show a measurable departure from random. The “‘bulge”’ (i.e., the excess over 1.00) of the 


over-all I.C. may be calculated by the formula p= PX Po, 
the bulge of the plain text (=.73), 8x the bulge of the key (which, since the key text is plain text, is also 
.73), and cis the number of categories (in this case, 26). Thus the expected bulge of plaintext autokey 


Te = 0213, so the I.C. is 1.02 





where 8, is the bulge of the cipher text, 8, 


traffic, without regard to the identity of the components involved, is 





in the general case. 

d. Where the components are known sequences, it is possible to establish the theoretical distribution 
for the ciphertext letters as well as the I.C. of the specific case. For example, in the case of direct standard 
alphabets, we would first construct a deciphering square (shown in fragmentary form in Fig. 636, below) 
from the normal enciphering form (Fig. 63a) of the Vigenére square; we then replace the key letters and 
the plaintext letters within the deciphering square by their relative frequencies (per thousand letters) in 













Plain Cipher Cipher 
ABCDE A B Cc D &E 
A;ABCODE A 74|74 10 31 42 130 
B}|}ZABCD B 10 1 74 10 31 42 
CiYZABC Cc 31) 19 1 74 10 31 
Dj XYZAB D 42 5 19 1 74 10 
Kev E|WXYZA Key E 130 | 16 5 19 1 74 
sn ti i i i a RIGA POGAGEGRGRGGGGS 
ttatateprtntgia test at DDD pretrctrDreTnBevggts 
X|DEFGH xX 5 | 42 130 28 16 34 
Y|CDEFG Y 19/31 42130 28 16 
Zi/BCDEF Z 1/10 31 42130 28 
Figure 63a Figure 636 Figure 63c 


English plain text * (Fig. 63c), and we multiply the entries in each row by the key-letter value for that 
row.” Since the square is a deciphering square, the sum of the entries in each column will represerit the 
relative frequencies of the cipher letters associated with the columns. For example, it will be found that 
the sum of the cross-multiplied values in the ‘‘A’’ column is 40,467, and that of the “B”’ column, 35,314; 
these of course represent frequencies per 1000? or 1,000,000 letters. The relative frequencies, reduced to 
a base of 1000 letters, are shown below: 





A 40.5 G 45.9 L 41.4 Q 30.9 V 51.7 
B 35.5 H 41.8 M 43.5 R 47.2 W 47.3 
C 31.6 1250.5 N 30.1 5S 42.2 X 40.8 
D25.0 J 30.1 0 28.0 T 41.4 Y 31.5 
E 47.5 K 35.8 P 34.3 U 30.4 Z 35.4 
F 39.2 999.3 


22 Since the relative frequencies shown are frequencies per thousand, what we have in effect are the probabilities of 
the letters to three decimals. For reference, the probabilities of English plaintext letters to four decimals are as follows: 


23 In the actual computation, a pair of strips bearing the letter frequencies was used, as an equivalent of the bulkier 


table. 
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A .0737 G .0164 L .0364 Q .0035 V_ .0153 
B .0097 H .0339 M .0247 R .0758 W_  .0156 
C .0307 I .0735 N .0795 S .0612 X .0046 
D .0424 J .0016 O .0753 T .0919 Y .0193 
E .1300 K .0030 P .0267 U .0260 Z_ .0010 
F .0283 1.0000 
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The sum of the squares of the probabilities of these cipher letters is found to be .0398; therefore the 
theoretical I.C. of plaintext autokey cipher with direct standard alphabets is 26(.0398) = 1.0348. 

e. By a similar process, the theoretical ciphertext distribution and the I.C. of plaintext autokey 
using reversed standard alphabets may be determined. The distribution, expressed in frequencies per 
1000, is found to be as follows: * 





A 66.9 G 34.8 L 45.4 Q 37.7 V 34.4 
B 39.9 H 33.9 M 37.3 R 38.1 W 44.1 
C 34.1 I 31.3 N 46.7 S 31.5 X 32.1 
D32.1 J 38.1 037.3 T33.9 Y 34.1 
E 44.1 K 37.7 P 45.4 U 34.8 Z 39.9 
F 34.4 999.8 


The sum of the squares of the probabilities here too is .0398, so the I.C. of reversed standard alphabets 
is the same as that for direct standard alphabets, namely, 1.0348. 

jf. The foregoing theoretical ciphertext distributions may be used in matching operations for testing 
samples of cipher text for possibility of encipherment by plaintext autokey with direct or reversed 
standard alphabets. For a quick test to determine whether a plaintext autokey system involves direct 
standard alphabets, we note (in subpar. d, above) that the cumulative frequencies of the highest four 
cipher letters, VIER, sum to 197, and that the cumulative frequencies of the lowest four letters, JNOD, 
sum to 113; the ratio of 197 to 113, or 1.7, compared with the random expectancy of 1.0, is indicative 
that direct standard alphabets may have been used. Similarly, for a quick test to determine whether a 
plaintext autokey system involves reversed standard alphabets, we observe (in subpar. e) that the 
frequencies of the four highest letters, ANLP, sum to 204, and that the frequencies of the four lowest, 
DXIS, sum to 127; the ratio of 204 to 127, or 1.6, compared with the expectancy for random of 1.0, may 
be employed to establish the use of reversed standard alphabets. (Note that the indices 1.7 and 1.6 
will obtain in these situations, regardless of the lengths of the introductory keys, or whether the traffic 
consists of messages in the same introductory key or in. many different keys.) 

g. The digital plaintext autokey systems illustrated in par. 36 all involved the additive method in 
their encipherment, wherein P+K=C. It was stated in the preceding volume * that an additive system 
may also be solved as a subtractive system (i.e., wherein P—K=C) or as a minuend system (i.e., wherein 
K—P=C), and that any one of these may be solved as either of the other two. Although this is true in 
the general cases of numerical polyalphabetic substitution, it is not true in the case of plaintext autokey 
systems: here an additive system can only be solved as an additive system, but a subtractive system 
may be solved as a minuend system, and a minuend system solved as a subtractive system, as is about 
to be demonstrated. 

(1) Let us consider three different encipherments of the same intermediate plain text by plaintext 
autokey and with the same 1-digit introductory key, first by the additive method (Fig. 64a), then by 
the subtractive method (Fig. 645), and finally by the minuend method (Fig. 64c): 


Additive enctpherment Sublractive enctpherment Minuend encipherment 
K:04351513343 K:0431513343 K:0431513343 
P>- 4315135 3433 PP»: 4315133435 P»} 431513343535 
C:4746646776 C:4984620190 C:6126480910 

Figure 64a Figur: 646 Figure 64c 


It will be noted that the subtractive and minuend encipherments are complementary. Now let us see 
what happens when the cipher text of each type of encipherment is assumed to have been produced by 
the additive, subtractive, and minuend methods in turn, from the standpoint of their particular genera- 
trix diagrams. 


* Note the symmetry of the distribution about A, and N,: the frequencies of M and 0 are identical, as are L and P, 
K and Q, etc. 
33 Cf. subpar. 846 on p. 238 of Military Cryptanalytics, Pari II. 
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Minuend trial 


Subtractive trial 


Additive trial 





(2) First, the cipher text of Fig. 64a (the true additive encipherment), under the assumption of 


encipherment by the three methods, with an arbitrary @ as the first plaintext digit: 
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Figure 65f 
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The original plain text will of course appear orf one of the generatrices of Fig. 65c, and the complements 
of the true plein on one of the generatrices of the minuend trial; the additive trial yields nothing. Finally 
the cipher text of Fig. 64c (the true minuend encipherment), under the assumption of the three en- 
ciphering methods: 


Additive trial Subtractive trial Minuend trial 
K: 0115991838 K: 013931101 XK: Oog97179909 
Cc: 6126480910 C: 6126480910 €: 6126480910 
P:0115991837 P: 01393110 1 P: 0971799099 
0O1l1l5991837 0139311011 0971799099 
1024082746 1240422122 1082800100 
2933173655 2351533233 2193911211 
3842264564 3462644344 3204022322 
4751355473 4573755455 4315133433 
§660446382 5684866566 5426244544 
6579537291 67959TTETT 6537355655 
7488628100 7806088788 7648466766 
8397719019 8917199899 BT595S T7877 
9206800928 9028200900 9860688988 

Figure 659 Figure 65h Figure 651 


Here the original plain text will appear on one of the generatrices of Fig. 652, as expected, while the 
complements of the true plain appear on one of the generatrices of the subtractive trial, with nothing 
manifested in the additive trial. In the foregoing cases, the original plain text will yield the reconstructed 
matrix of Fig. 66a, below, whereas the complementary plain text will yield the equivalent matrix of 
Fig. 660. 





ahanre 
aan~ To oO 


Fiaure 664 Ficure 66b 


h. Digital ciphertext autokey systems also have their restrictions in their analysis as regards their 
type of encipherment: here a subtractive system can only be solved as a subtractive system, but an ad- 
ditive system may be solved as a minuend system, or vice versa. As an example, let us examine three 
different encipherments of the same plain text by ciphertext autokey, by the additive method (Fig. 
67a), the subtractive method (Fig. 67b), and the minuend method (Fig. 67c): 





Additive encipherment Sublractive encipherment Minuend encipherment 
K: 0478347047 K 0492385867 Ki: 0632763063 
P: 4315133433 PP: 4313565133433 PP: 4315133433 
C: 4783470470 €C: 4923858676 C: 6327630630 

Figure 67a Fiaure 676 Figure 67¢ 
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(Here it will be noted that the additive and minuend ericipherments are complementary.) Now we shall 
see what happens when the cipher text of each case is assumed to have been produced by the additive, 
subtractive, and minuend methods, in turn. First, the cipher text of Fig. 67a (the true additive encipher- 
ment), under the assumption of encipherment by the three methods: 


Additive trial Subtractive trial Minuend trial 
K: 478347047 K 478347047 K 478347047 
C: 4783470470 C: 4783470470 C:4783470470 
P: 315133433 P: 151717417 OP: TOIOS5977677 
Figure 68a Figure 68b Ficure 68c 


The original plain text appears in the additive trial, its complement in the minuend trial, and nothing 
in Fig. 68). Next, the cipher text of Fig. 675 (the true subtractive encipherment), under the assumption 
of encipherment by the three methods: 





Additive trial Subtractive trial Minuend trial 
K: A9Q2385867 K 492385867 K: A923 85867 
Cc: 4923 858676 C: 4923 858676 CC: 4923858676 
P: 531573819 P 315133433 P: §7953 7291 
Ficure 68d Figure 68e Ficuret 68f 


Here the original plain text comes out under the subtractive trial, but nothing in Figs. 68d or f. Finally, 
the cipher text of Fig. 67c (the true minuend encipherment), under the assumption of encipherment by 
the three methods: 








Additive trial Subtractive trial Minuend trial 
K: 632763063 K 632763063 K: 632763063 
C:-632763 0630 C: 6327630630 C: 6327630630 
P; TO9S59T7T7T6E7T7 P 959393693 P: 315133433 
Ficure 689 Figure 68h Ficurr 687 


The original plain text here comes out under the minuend trial, its complement under the additive 
trial, and nothing in Fig. 68h. As before, the original plain text will yield the matrix of Fig. 66¢, the 
complementary plain text the matrix of Fig. 668. 
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36. Preliminary remarks.—a. In subpar. 1d it was stated that two procedures suggest themselves to 
cryptographers for eliminating the weaknesses introduced by periodicity of the type produced by sim- 
ple, repeating-key methods. One of these, when studied, embraced some of the very simple methods of 
suppressing or destroying periodicity, by such devices as interrupting the key and using variable-length 
groupings of plain text. It was demonstrated that subterfuges of this simple nature are inadequate to 
eliminate the weaknesses referred to, and must be discarded in any system intended to afford real 
security. The other alternative alluded to in subpar. 1d therefore remains now to be investigated, viz., 
that of lengthening the keys to a point where there would seem to be an insufficient amount of text to 
enable the cryptanalyst to solve the traffic. Attempts toward this end usually consist in extending the 
key to such a length that the enemy cryptanalysts will have only a very limited number of periods to 
work with. The key may, indeed, be lengthened to a point where it becomes as long as, or longer 
than, the text to be enciphered, so that the key is used only once in a message. 

b. It is obvious that one of the simplest methods of lengthening the key to a message is to use a 
long phrase or even a complete sentence, provided that it is not too long to remember. In addition to 
the difficulties that would be encountered in practical military cryptography in selecting long mnemonic 
phrases and sentences which would have to be imparted to many clerks, there is the fact that the 
probable-word method of solution still remains as a powerful tool in the hands of the cryptanalyst. 
And if only a word or two of the key can be reconstructed as a result of a fortunate assumption, it might 
be possible that the cryptanalyst could guess the entire key from a fragment thereof, since any long 
phrase or sentence which is selected because it can easily be remembered is likely to be well known to 
many people. 

c. There are, however, relatively simple ways of employing a short mnemonic key in order to produce 
a much longer key. Basically, any transposition method applied to a single alphabetic sequence repeated 
several times will yield a fairly long key, which, moreover, has the advantage of being unintelligible, 
thus approaching the appearance of a random selection of letters. For example, a numerical key may be 
derived from a word or a short phrase; this numerical key may then be applied as a columnar-trans- 
position key for a rectangle within which the normal A-Z sequence has been repeated a previously 
agreed-upon number of times in straight horizontals starting at the upper left-hand corner, or in any 
other prearranged manner. The letters when transcribed from the transposition rectangle then become 
the successive letters for enciphering the plain text, using any desired type of primary components. 
Or, if a single transposition is not thought to be sufficiently secure, a double transposition will yield a 
still more mixed-up sequence of key letters. Other types of transposition may be employed for the 
purpose, including various types of geometric figures. Furthermore, some nontransposition methods of 
lengthening the keying sequence which at the same time introduce an irregularity, such as aperiodic 
interruption, have already been described (see subpar. 146). 
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d. Another method of developing a long key from a short mnemonic one is that shown below. Given 
the key word CHRISTMAS, a numerical sequence is first derived and then the successive sections of this 
numerical key are written down, these sections terminating with the successive key numbers 1, 2,3, . . . 
of the numerical key. Thus: 

Mnemonickey:C HRISTMAS 
Numerical key: 23647951 8 
1|2 3 4 5 6 7 
Extended key: CHRIS TM alclc nlc HR tle HRIST ulc H Ric HRIS 


8 9 
CHRISTMAS|ICHRIST| 


Thus the original key of only 9 letters is expanded to one of 45 letters (1+2+3+ ...+9=45). The 
longer key is also an interrupted key of the type noted under subpar. 14a, but if the message is long 
enough to require several repetitions of the expanded key, the encipherment becomes periodic and can 
be handled by the usual methods employed in solving repeating-key ciphers. If the basic key is fairly 
long,' so that the expanded key becomes a quite lengthy sequence, then the message or messages may 
be handled in the manner explained in par. 19. 

e. One method for producing a rather long sequence of digits for keying purposes from a single key 
number is to select a number whose reciprocal when converted by actual division into its equivalent 
decimal yields a long series of digits. For example, the reciprocal of 49, or 1/49, yields a sequence of 42 
digits beginning .0204081632 . . . . Such a number, coupled with a key word like CHRISTMAS, 
could be used for interrupted keying, the successive cipher alphabets being used for enciphering as many 
letters as are indicated by the successive digits. In the case of the example cited, the first digit is 9; 
hence the C alphabet would not be used. The next digit is 2; the H alphabet would be used for enciphering 
the first and second letters. The third digit is again 9; the R alphabet would not be used. The fourth digit 
is 4; the I alphabet would be used for enciphering the third, fuurth, fifth, and sixth letters. And so on. 

f. In the case of digital cryptosystems, various methods have been used to produce an expanded 
key from a shorter one. Several examples will now be cited. 

(1) The method in subpar. d, above, may be adapted so that from the key word CHRISTMAS 
the basic numerical key 236479518 is expanded into the 45-digit sequence 2364795 1|2[2 3| 
2364|2364795|236/23647|\236479518:|236479. Or, this 9- 
digit basic key may be expanded into an 81-digit key by tying together 9 cycles of the basic key, beginning 
wih 182364795|236479518|36.. . and ending with 1951823 
6 4 7. Or, again, the 9-digit key may be expanded into a 90-digit key by adding 1 to the digits of the 
basic oe the end of each cycle, so that the final key will be 23647951 8|34758 
0o629|45. 


(2) Another method for producing digital key is by a ‘‘Fibonacci series,” * which is a series or se- 
quence generated by the successive addition (almost invariably mod 10, or, in certain specialized usages 
mod 2) of pairs or larger combinations of elements (usually adjacent), beginning with a specified initial 
key number. Thus, in its simplest form, if the initial key is the dinome 01, we can generate the Fibonacci 
sequence 0112358314 . . . , which has a cycle length of 60. If the initial key is the pentanome 00001 
and the rule of combination is a+b=f (i.e., the sum of the first and second elements of the sequence 


1 For example, if the basic sequence were a 26-letter mixed sequence such as HBPYEQDFSRGTAJ VUKWLMXINZCO based 
on HYDRAULIC, then the expanded key would read 


1 2 3 
HBPYEQDFSRGTA|HBINBPYEQ. . . C\H B P ete. 


The length of the expanded key is the sum of the first » numbers, given by the formula Z(n)=1+2+3+ ... +n= 
an), since n=26, the total key length is 351. A possible alternative is the construction of a 676-long key by fitting 
together 26 cycles of the basic sequence, the successive cycles beginning with A, B,C, . . . (orH, ¥, D, . . ., or any other 
scheme for including all 26 letters for the starts of the cycles). 

2 This series is named after Leonardo of Pisa (ca. 1170-1248), also known as Fibonacci (i.e., ‘‘filius Bonacci,’”’ or “son 
of Bonacci’’), who first investigated its properties in connection with the proliferative activities of rabbits. 
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equals the sixth), at the end of the first 50 digits the sequence will read 1542869604 . . . , continuing 
for a cycle of 16,401 digits; on the other hand, with this same initial pentanome and the rule of combi- 


~ nation a+ctdt+e=f, the cycle of 19,344 digits is reached, maximum for this length of initial key.* 


The mathematics involved here is related to the mathematics of shift registers (see subpar. 58h); in 
fact, some shift register feedback rules are called ‘‘Fibonacci rules.” The shift register cases all involve 
mod-2 arithmetic; the mod-10 version, as illustrated here, has additional complications. 

g. In connection with the subject of extensive or lengthy keys is the cipher system known as the 
running-key, continuous-key, or nonrepeating-key system, in which the key consists of a sequence of 
elements which never repeats, no matter how long the message to be enciphered happens to be. Although 
any continuous text could be used, the most common and most practical source of such a key is that in 
which the plain text of a previously agreed-upon book serves as the source for successive key letters 
for encipherment;‘ or, in a numerical cryptosystem, the key could be obtained from various mathe- 
matical tables or even from a telephone directory. Even though in a running-key system the key for 
an individual message may be as long as the message and never repeats, nevertheless, if a large group 
of correspondents employ the same key sequence, it may happen that there will be several messages 
in the same key, and they will all begin at the same position in the keying sequence; or there might be 
several messages which will overlap one another with respect to the key, even if they begin at different 
points in the keying sequence. These situations form the basis of solution of systems of this genre. 

h. In addition to the foregoing manual methods, there are a great many mechanical methods of 
producing a long key, such as those employed in mechanical or electrical cipher machines. In most: 
cases these methods depend upon the interaction of two or more short, primary keys which jointly 
produce a single, much longer, secondary or resultant key (see par. 4). Only brief reference will be made 
at this point in the cryptanalytic studies to cases of this kind; the matter will be taken up in detail in 
Chapter IX. 


3 The mathematics of Fibonacci cycles involves complicated aspects of algebra and number theory, and there is no 
short cut to the determination of the cycle length, given any specified initial key and rule of combination. For the in- 
terested reader, the table below gives the cycle lengths for all rules of combination (always including the a digit) for penta- 
nomic initial keys; the number in parentheses indicates the number of different cycles of that length. (For a stated rule of 
combination, the initial group 00001 always gives rise to a maximum cycle.) 





atb=f atc=f atd=f ate=f atbic=f__|_a+bid=f atb+e=f atcid=f 
16,401 (4) | 744 (129) | 6448 (15) | 168 (500) | 840 (80) 1560 (60) | 6248 (8) 9372 (4) 
5,467 (4) | 124 (32) 208 (15) 84 (33) 168 (100) 312 (20) | 3124 (12) | 4686 (4) 
2,343 (4) 31 (1) 124 (1) 42 (16) 140 (20) 30 (4) 1562 (4) 3124 (4) 
781 (4) 24 (1) 31 (1) 28 (1) 120 (80) 15 (2) 781 (8) 2343 (8) 
21 (1) 1 (1) 4 (1) 24 (500) 28 (24) 2 (4) 8 (2) 1562 (4) 
T (1) 1 (1) 21 (1) 24 (100) 1 (2) 4 (3) 781 (8) 
3 (1) 12 (33) 20 (20) 2 (1) 12 (1) 
1 (1) 7 (1) 14 (1) 1 (2) 6 (1) 
6 (15) T (2) 4 (1) 
5 (1) 4 (24) 3 (2) 
4 (1) 2 (1) 2 (1) 
3 (1) 1 (2) 1 (2) 
1 (2) 
atc+e=f a+d+e=f atbictd=f |_atb+c+e=f | atbid+e=f | a+cidt+e=f atbtctdt+e=f 
1860 (48) | 10,934 (4) | 744 (129) | 744 (129) | 1240 (72) | 19,344 (5) | 4686 (16) 
930 (4) 5,467 (8) | 124 (32) 124 (32) 620 (6) 624 (5) | 2343 (8) 
372 (16) 1,562 (4) 31 (1) 31 (1) | 248 (15) 124 (1) 781 (8) 
62 (4) 781 (8) 24 (1) 24 (1) 124 (1) 31 (1) 6 (4) 
60 (12) 14 (1) 1 (1) 1 (1) 40 (72) 4 (1) 3 (2) 
15 (2) 7 (2) 31 (1) 1 (1) 1 (2) 
12 (4) 2 (1) : 20 (6) 
1 (2) 1 (2) 8 (15) 
4 (1) 
1 (1) 


4 The key is either the plain text itself as key letters, or a transformation of the plaintext key into digits, say, by 
enciphering the plain text through a monome-dinome rectangle. See in this connection Appendix ‘‘A”’ (on pp. 250-256) 
of Alexdnder Foote’s Handbook for Spies, New York, 1949. 
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i. Finally, there must be mentioned certain devices in which, as in encipherment by the autokey 
method, the text itself serves to produce the variation in cipher equivalents, by controlling the selection 
of secondary alphabets, or by influencing or determining the sequence in which they will be employed. 
Naturally, in such cases the key is automatically extended to a point where it coincides in lengih with 
that of the text. An excellent example of such a device is the Wheatstone cipher device,> the solution of 
which will be treated in Chapter VIII. 

37. Depth and its exploitation—a. The concept of depth was introduced in the previous text;® it 
was pointed out that, unless special circumstances are present, the re-use of key, either within a message 
or among several messages, is a necessary condition to the solution of polyalphabetic ciphers The 
sole exception is the case wherein the components are known and the continuous, nonrepeating key is 
plain text (or has otherwise recognizable systematic or exploitable nonrandom properties); correct 
cribs in either the plain text or the key will enable a solution to be effected—but this of course in reality 
is tantamount to a depth of tw 

b. The solution of a single message in a periodic polyalphabetic cipher involving unknown primary 
components rests on the ability of the cryptanalyst to superimpose cycles of the period into a crypto- 
graphic depth, i.e., so that all the cipher letters in the individual columns of the depth diagram belong 
to individual monoalphabetic distributions. 


d. We shail now take up the solution of csyptograms involving long er continuous keys under the 
two general cases: (1) those wherein the primary tomponents are known sequences, and (2) those wherein 
they are unknown. oe 

38. Solution of a single cryptogram involving } known primary components and an unknown plaintext 
running key.—ca. This is a trivial case, since what-we have is really a depth.of two (i.e., the plain text of 
the message, and the plain text constituting thé kéy) ; tf the primary components are agar sequences, 
a correct assumption of plain text in either the-cipher’ ‘or the key will produce plain text in the other. 
Furthermore, if a novel or other book is used as key, upon the recovery of sufficient key text the crypt- 
analyst might be able to identify the particular book that i is being used for the key, which would greatly 
simplify his subsequent efforts. 

b. As an example, let us suppose that we have at hand the following short cryptogram, assumed to 
have been enciphered with direct standard alphabets ‘and a plaintext running key: 


EUGEM NLLHG BYDQV‘SX%PMF AAGZJ BKWAX 
FRHFA QAAHK GSLIF L+XiCWV REKDQ DYWMF 
XKLAC YDRLL GICCE XLarV 0 Q HRRHF RPTNL 


The procedure here is to try sliding probable words of ‘other plaintext polygraphs through the cipher 
text, seeing what plausible key fragments are produceds thereby, and expanding the placed crib and its 


5 Some writers classify and treat this method, as well as autokey: methods, as forms of the running-key system, but 
it is preferable to consider the latter as being radically different irt principle from the fotmer types, because in the true 
running-key system the key is wholly external to and independent of the text being encipheyed. This is hardly true of auto- 
key systems or of the Wheatstone device. 


6 Cf. par. 65, Military Cryptanalytics, Part II. +." - 





. Subpars. 146 and c of Chapter III. . 
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_ associated key elements. For instance, if we slide TION through the text, we would construct the diagram 
shown in Fig. 69, below (under the assumption of A, as the index letter): ° 


EUGEMNLLHGBYDQVSXPMFAAGZJIBKWAXFRHFA 












TILBNLTUSSONIFKXC TMHHNG EMYOMH 
I MYWEFDDZYTQVINK XSSYRB 0 XJZXS 
0 SQYZXXTSNKPCHEJ MMSLVWN DTRM 
N RZAYYUTOLQDIFKC NTMWOX USN 
(FRHFA)QAAHKGSLIFLXCWVREKCQDYWMFXKLAC 
TIMYO X HH PMSEJDC RJXK TMERSHJ 
I|xX JZX sSZ Y XDPUONJ CUIVQ XPCDSU 
OIR.DTRM MT W XJOIHDQWOCPKI JWXMO 
NISEUSND UXT Y YKPJIERX QLJZ X Y NP 
(XKLAC)YDRLLGICCEXAVOQHRRHFRPTNL 

T |E HJFKYSSNPJJL VXOYYOMYW 

I |P UQVJDDYAUUWP ZJIJZXJIHL 

0 |J OKPDXXSUOOQJM TDDTRDBFZ 

N |K QEYYTVPPRKNI D EUSECGAY 

Ficure 69 


Several candidates for plaintext key fragments are noted and are marked in the diagram, the best one 
perhaps being SARY, as part of the word NECESSARY. Key and plain text are expanded simultaneously, 
as shown in the following successive steps: 


25 , FU] 35 40 45 50 
K: snecesSARYfor 
C:....AAGZIBKWAXFRHFAQAAHKGSLIFLXCWYV 
P: indicaTIONsof 
* & & He & 
2 30 35 40 45 50 
K: itbecomeSNECESSARYFOR 
C: -AAGZIBKWAXFRHFAQAAHKGSLIFLXCWYV 
P: seenfromINDICATIONSOF 
* *& & He 
25 30 35 40 45 50 
K: entsITBECOMESNECESSARYFOR 
C: ...AAGZJIBKWAXFRHFAQAAHKGSLIFLXCWYV 
P: foreSEENFROMINDICATIONSOF 


At this point we assume a verb before the word FORESEEN, and we try IS (yielding the key YH), WAS 
(=EGHx), ARE (=APV;), BE (=FVx), among others. The E,=V, looks promising, however, and we 
suddenly recognize the key text as coming from the Constitution of the United States. The problem is 
now solved: 


K: WHEN 
C: EUGE 
P: INCR 


RH 
rae 
urs 
wrx 
ovirnm 
mMoQas 
z2wo 
AKG 
Zon 
eon 
Aas 
mnoO 
Ns 
HU 
NEG 
HIS 8 
>> PS 
zara 
aQam Bi 
BaN< 
1a PIS 
ow=m 
ARH 
maM 
nN eH 
<4 8 


o 


Note that we could also have solved a problem such as this 
develops in the decipherment of the cipher text. 


y assuming key text, and seeing what 


* Cf. subpar. 22d on pp. 41-42 of Military Cryplanalytics, Part IT. 
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(The digraphs obtained from reversals are shown in parentheses.) The cipher component may now be 
chained out and reconstructed in its original form, and the plain component can be recovered in a few 
moments by taking advantage of the now-known cipher component. The completion of the solution, 
including recovery of the key for the messages, is again left to the reader as an exercise. 

41. Recovery of plain texts and the unknown primary components from a number of messages in 
flush depth.—a. In the previous text " it was noted that if there were available a sufficient number of 
messages (say 25-30, for English) all enciphered beginning at the same point in a long key, the messages 
would be in flush depth, and the frequency distributions of the columns of the superimposition diagram 
could be solved, without knowing the length of the key.? It was further noted that even if an extremely 
long key is employed and a series of messages beginning at different initial points is enciphered by such 
a key, this method of solution by superimposition can be employed, provided that the messages can be 
superimposed correctly—that is, so that the letters which fall in one column really belong to one cipher 
alphabet. Messages may be put into depth as a result of the solution of indicators, or by means of long 
ciphertext repetitions, or by means of the kappa (x) test. 

b. The kappa test has been treated at some length in the previous volume; a review at this time might - 
not be amiss." The kappa test, or its equivalent form, the kappa I.C., involves nothing more than counting 
hits between two superimposed messages, and evaluating the result. We know, for instance, that since 
the repeat rate for English (i.e., the x,) is .0667, if two 1000-letter messages are properly superimposed 
with respect to their keying sequence (i.e., so that both letters of a vertical pair have been enciphered 
by the same key letter), we should expect 66 or 67 hits between them if the underlying text is English; 
and if these same messages are not correctly superimposed, the repeat rate for random («,=1/26=.0385) 
should prevail, so that the expected number of hits will then be 38 or 39. A demonstration of the application 
of the kappa test will now be given. 





" Cf. par. 65 (on p. 157) of Military Cryptanalytics, Part IT. 
12 Prob. 9 (on p. 608) of Section G, Appendix 9, Military Cryptanalytics, Part 11. 
8 Cf. par. 98 on pp. 302-308 of Military Cryptanalytics, Part I1. 
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Cuaprer VII 
CYLINDRICAL CIPHER DEVICES AND STRIP CIPHER SYSTEMS 
Paragraph 
Generals 4.25 o520255 $252k Su kos s Geen Set ecacd oso seen Sat ehole aeeceeace se eene choses eagieeeteaas 45 
Reconstruction of unknown cipher alphabets._..______._______-_.---------------------------------------- 46 
Analysis of cryptograms involving known alphabets but with unknown keys. ____-_---___-------------------- 47 
Further remarks=<.- 2 5... coco 22 veh Sot soe Mou Si sod bc sutsousudeteetosiet Se lusseecol ee veuc ocebewouls 48 


45. General—a. The cryptography of cylindrical cipher devices and strip cipher systems was 
treated briefly in the previous text.’ In the first published description of a cylindrical cipher device,’ 
the apparatus consisted of 20 numbered rotatable disks, each bearing a different alphabet engraved on 
its periphery. The disks were to be arranged in an agreed-upon order on a shaft, and rotated so that the 
first 20 letters of the message plain text appeared in a row; the cipher text was then formed by arbitrarily 
taking off any other row—thus the basic cryptoprinciple is that of polyalphabetic substitution with the 
added complication of a variable generatriz feature. The remaining letters of the message were to be 
treated in the same fashion, 20 letters at a time. In decipherment, the disks were first arranged on the 
shaft according to the agreed-upon order, the first 20 cipher letters set up across one row, and the other 
rows searched for the one and only one row that contained plain text all the way across; and so on for 
the rest of the decipherment. 


b. Credit for the original invention of the cylindrical cipher device belongs to Thomas Jefferson, 
among whose papers in the Library of Congress (vol. 232, item 41575, Jefferson’s Papers) there was 
found in 1922 a description of a device incorporating 36 disks, on each of which are placed ‘‘all the letters 
of the alphabet, not in their established order, but jumbled & without order so that no two shall be 
alike.” The device was independently invented for the third time by Captain Parker Hitt, U.S. Army, 
who in 1914 conceived a device of 25 disks, and also a similar apparatus of flat strips, cryptographically 
equivalent to the disk device. Hitt’s alphabets were not very thoroughly mixed and bore many relation- 
ships among them so as to enable their reconstruction from memory—for example, there were many re- 
petitions of sequences such as AEIOU, BCDFG, and HNRST. Major Joseph O. Mauborgne (later to become 
Chief Signal Officer of the U.S. Army) in 1917 noted that, because the alphabets were not thoroughly 
scrambled, the cryptograms produced by Hitt’s device were too easily solved; his modification of the 
device, prescribing that “each disk have on it 26 letters of the alphabet, nonrepetitive on any disk and 
as far as possible so arranged that the fewest number of repetitions of pairs of letters . . . would occur,” 
resulted in the adoption by the U.S. Army in 1923 of the cylindrical cipher device known as the M-94. 

e. A strip cipher system comprises a series of printed, random-alphabet strips to take the place 
of the disks of a cylindrical cipher device; these strips, bearing identifying numbers, slide freely in the 
channels of a strip board which may be made of metal, wood, or plastic. The strips are simpler to pro- 
duce and more economical to replace than metal disks; but, most important of all, with the use of strip 
cipher systems it is possible to incorporate certain simple modifications of the Jefferson principle (i.e., 
the variable-generatrix principle) which result in a very considerable augmentation of the security of 
the system. First of all, in cylindrical cipher devices the number of disks must be limited, for the sake 
of practicability, and furthermore all n disks (20 in the Bazeries device, 25 in the M-94) are always 
used together, so that the latent period is always n. But with a strip cipher system, it is possible to em- 
ploy, say, 100 or more strips in the basic system, and then choose, for example, 30 of these strips for a 
daily key; furthermore, it is possible to employ a variable keying element for each message, so that 
several of the strips are eliminated before encryption begins, avoiding the possibility of the encryption 
of two messages in exactly the same key, and in general resulting in a latent flexible periodicity. Finally, 
because of the ease of production of paper strips, it is possible to have different sets of strips for dif- 
ferent groups of holders, or for various types of traffic, thus reducing the volume of traffic in any one 
cryptosystem. 


' See Military Cryptanalytics, Part II, pp. 443-444. 
2 Etienne Bazeries, Les chiffres secrets dévoilés, Paris 1901. 
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d. The analysis of cylindrical cipher devices and strip cipher systems involves two main aspects: 
(1) when the alphabets are unknown, and (2) when the alphabets are known, but their specific order is 
unknown. These cases will be discussed in the succeeding paragraphs. 

46. Reconstruction of unknown cipher alphabets—a. Let us assume that we have at hand the 
compromised plain text to a long cipher message, known to involve a cylindrical cipher device or strip 
cipher system of 25 alphabets.*? The matched plain and cipher, written on a width of 25, is shown below: 


1. THEFO LLOWI NGALT ERNAT EPLAN 21. AGENE RALLY PARAL LELOF ROADS 


EPWWZ VIUFT EVTJB MCFIH IBRSP ZJAKJ ADJTT JXULT BVMEE WJITJ 

2. SOFDE FENSE FORTH EREGI MENTA 22. TOONE THREE THREE THREE STOPO 

HEETJ DFCMZ WKUKR ZGWAA GYFKM QUMWM AXYFL MQPGN GEKKS JYYXE 

3. LRESE RVELI NESAR EHERE BYSUB 23. RDASH TOEXT ENDRE GIMEN TALDE 

PACCX ZSSXE WMVPM PZZKJ MSJSF FGZRN ZHPZK UKVQM OEKXZ BJWLW 

4. MITTE DCOLO NONED ASHAG ENERA 24. FENSI VELIN EBYTA KINGU PPOSI 

NPEFO ENNQW FBZKK VLLCI WYQWG BREPN WQBAB YHXVQ XXXOM QRRBP 

5. LDEFE NSEOF REGIM ENTAL RESER 25. TIONS INDEF ENSEO FNORT HWEST 

IUQVK KAANS VCRGU BUCHJ UXXJI UDLQR GJUIE KWXTN DINVC AOXUS 

6. VELIN ESCOM MAWIT HDEPL OYMEN 26. SLOPE OFBUC KHILL ANDSO UTHSL 

NPIWL HZXXE GKHMV IOIVF TQRKS USXFP JKUKT PSQKU LJRFC HNXPI 

7. TOFTH REERI FLECO MPANI ESINL 27. OPESO FDISC UMHIL LSTOP FOURD 

CAUGN MUPHM OIUOH FYVPF TGEBI HVMNN WRGCU QVCWW MFVDY OMRCT 

8. INESU PPORT EDBYC OMPAN YHAND 28. ASHIN CASEO FATTE MPTED ENEMY 

LJWUW JWUGE WJPQV WWAIX PYLQM YTTQR WVJXX QTAFL EACYQ LOSTP 

9. USING THERI FLECO MPANY MACHI 29. PENET RATIO NSTHR OUGHL EWISV 

VWZTX EAQCW RFFZX IDHXL JYJCK TQBPF ADQCK AJDDN RACOC AMTVN 

10. NEGUN SFROM SELEC TEDPO SITIO 30. ALLEY DASHT OCOUN TERAT TACKF 
YYQAH CNHLI ZUWPA HIVNG PXJWH DGJGZ JBXPZ ZPNXF RDIFY KLXLR 

11. NSFRO MTHIS LINES TOPTW ODASH 31. ROMEA STSLO PEOFB UCKHI LLORF 
LNSGF JUGJN RBOZB ANNUP VYJQA EXCLI GNHJZ YQIIE VVAKJ KQJVM 

12. DEFEN SEOFR EGIME NTALR ESERV 32. ROMSO UTHWE STSLO PEOFH ERRHI 
QODLJ GOQBI QKUVD RPOMB QNMVE TIWTF PUGNY EHKHU HMMAV KIBLS 

13. ELINE SSTOP THREE DASHI NCASE 33. LLSTO PFIVE DASHI NCASE OFATT 
VGRAA EFPFU PTCMW YTQBS XVVZZ SUIYT ITJED YFYTS TQMUH YIWHA 

14. OFATT EMPTE DENVE LOPME NTOFO 34. EMPTE DENVE LOPME NTOFO URLEF 
LIDNJ TQJZL IWCIN XFLIS KYYRE UNXAF SVXYH PQIKF WXRCH TPPIC 

15. URRIG HTFLA NKDAS HTOCQ UNTER 35. TFLAN KDASH TOEXT ENDOU RDEFE 
EYZZL LDJEZ TUEGP ZVDFR EDXWY PVGHJ CACFV HCBML NHPHO JJMMB 

16. ATTAC KFROM VICIN ITYOF RJONE 36. NSELI NEBYT AKING UPPOS ITION 
NKRSH FCEQN XXNVE GFKTG HRFHO KYAEA GFTOB YGOHA OTDEQ MQTMO 

17. THREE THREE THREE MOVIN GFROM 37. ONNOR THEAS TSLOP EOFSY KESHI 
RLDGA INGNG PTCMW XSFUG FHFNT ULGGK JLWLH KTPGQ RKLWA ZATUM 

18. RESER VEASS EMBLY POSIT IONWE 38. LLORB UTLER HILLO RTOCO UNTER 
BLYJE OVWZI XCTMT BZBPI RFAED GRISX FPXWK BLWWB PGUQG NTJPA 

19. STVIA STONE WALLC OMMAS OUTHW 39. ATTAC KFROM BUTLE RHILL ORGEN 
BVKLK MJVXJ CHKRQ AHBLM FAHIR QSHOU NPOBK UWIJA QKPKG WVYVP 

20. ESTVI ASTON EWALL TOROA DCOMM 40. ERALL YALON GTHEM ORLAY TRAIL 
IBVPT GYDIM JONEJ GFKJU QOYVP YHGPA FIMGZ LSTAK NUFNN RUTVS 


3 The diagnosis of a strip cipher system was made from the characteristic frequency distribution—made cumulatively 
on all the traffic—associated with a noncrashing system (see subpar. 48c); the number of strips involved was determined 
from the factors of intervals between long polygraphic repetitions found within or between messages. 
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b. Our first step is to make tabulations of the columnar plain-cipher equivalencies, as a prelude to 

the establishment of related lines of matched plain and cipher. In these tabulations the vertical plain- 
‘cipher digraphs have been recorded (under the reference alphabet) as single-letter entries under the 
earlier letter in the normal alphabetic sequence, so that, in col. 1 for example, TE and SH are recorded 
in the inverse form as ET and HS, while LP is recorded as LP. The tabulations for the first five columns 
of the 40 pairs of lines are shown below, where letters that have occurred at least twice in combination 
with the reference letter are ringed. 


Col. 1: 


Col. 2: 


Col. 3: 


Col. 4: 


Col. 5: 


ABC JKLMN QR UVWX YZ 
NTSWNS Y 


ABCD HIJKULUMNOPOQ UVWXYZ 
T P 


> 
os io 


D GHIJKLMNOPQRSTUVWXYZ 
XQTQRN O02 S W Z 
LQN RT 


a ryja 


rOOx® 


aug) RO xOlm 


* ££ eH HF FE 
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c. The summary of related lines of matched plain and cipher from the foregoing five tabulations 


is given below: ‘ 


Col. 1: EU 15, 34 Col. 4: EL 12, 31, 36 
PT 29, 35 EG 17, 30 
RT 17, 32 NT 9, 14 
IL 5, 8 RS 23, 38 
Col.2: EO 2, 12 Col. 5: AE 13, 17 
GL 13, 30 AI 31, 36 
ST 28, 39 EJ 2, 21 
FO 11, 32 

Col. 3: AE 21, 36 HN 7, 10, 23 
EW 1, 8 JN 12, 35 
HT 28, 39 Pa a a a 


A family of seven related lines (2, 12, 21, 29, 31 , 35, 36) is evident among the relationships set forth 
above; and several more families of related lines may also be built up from the foregoing data. If we 


examine all 40 lines, we will arrive at the following families: 


Family “A”: 2, 12, 21, 29, 31, 35, 36 
Family “B’: 1, 5, 8, 28, 39 


Family “C”: 7, 10, 23, 26, 38 
Family “D”: 9, 14, 16, 20, 22 
Family “E”: 11, 13, 17, 30, 32 
Family “F’: 15, 18, 24, 34 
Family “G”’: 3, 25 


Family “H”: 19, 27 
Family “I”: 37, 40 


Lines 4, 6, and 33 are isolated members of three different families: a maximum of 13 families in all is 


possible. 


d. The relationship among the seven members of Family ‘“‘A” is made clear when we examine the 


lines of matched plain and cipher: 


2. Si0\F D(F}] FENSE FORTH EREGI MEN 
H\EETW DFCMZ WKURR ZGWAA GYF 
(2) pier eres. EGIME NTALR ESE 
QioiD GOQBI QKUVD RPOMB QNM 
21. - ce) eee PARAL LELOF ROA 
Ki ADJTT JXULT BVMEE WJI 

te RATIO NSTHR OUGHL EWI 
iDQBPF ADQCK AJDDN RACOC AMT 
(1) Rom ray STSLO PEOFB UCKHI LLO 
EXCUWAI GNHJZ YQIIE VVAKJ KQJ 
(5) Tyr LA KDASH TOEXT ENDOU RDE 
\VGHW) CACFV HCBML NHPHO JJM 
lee AKING UPPOS ITI 
KY\WWEWM, GFTOB YGOHA OTDEQ MQT 


4 The tilde (~) over the numbers indicates an inverse relationship between the lines involved; 


in subpar. d, below. 
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In this diagram, the identities of encipherment in the first five columns have been marked with a solid 
oval ring, while the inverse (i.e., reciprocal) relationships have been marked with a dotted oval ring. 
Thus it may be seen that lines 2, 21, 29, and 36 involve the same plain and cipher generatrices, 
while lines 12, 31, and 35 involve the same generatrices, but interchanged between plain and cipher. 
This means that for Family ‘‘A’’ we can establish the following two-letter chains as belonging to col. 
1 (i.e., alphabet 1): 


(Note that we have reversed the letters of the digraphs from lines 12, 31, and 35 which bear an inverse 
relationship to the other four lines.) 

e. Since Families ‘‘A’’ through “‘F’’ contain the most members, we proceed to make chains for the 
individual alphabets. Below are given the chains for the first five alphabets, as an illustration: 


Family “A” Family “D” 
1. SH QD AZ PT ER NK 1. VU OL NA EI TQ 
2. XOEQ GJ VF SY 2. WSB FI KT OU 
3. DFEA NB CM GL 3. ZI AD RTV OM 
4. DT LEP NK HA 4. TNW SA VP 
5. EJN TF IA 5. XG ITJ HC EM 
eR ROK * ek eR 
Family ‘‘B” Family “E”’ 
1. TE IL YAQ 1. LN EV TR AD 
2. HP UD NJ TS 2. NS HLG I10 
3. QEW TH 3. SF IRD LJ WM 
4. VFW SU QI AO 4. EGR NA TS 
5. 0Z KE CUW RN 5. FO EA YZ 
* ke ke Kk x * *& kk * 
Family “C” Family “F” 
1. TC YN RF SU GL 1. EU RBF 
2. OA YE RLS DG 2. YREL MN 
3. FU QG AZ I0X 3. ZR SY EN PX 
4. TG AU SR PF 4. ZI EJ PS TA 
5. HN EP XB 5. LG REF NI 
* * kk k kK * * & £ * 


We can now begin to amalgamate the chains within each alphabet in order to reconstruct the strips 
involved. In employing the graphical method of indirect symmetry, we arbitrarily assign to Family 
“A” the direction | , and to Family ““D” the horizontal direction—. Thus in the initial reconstruction 
of the first five alphabets, we shall have the following partial diagrams, among lesser fragments: 


Alph. 1 Alph. 2 Alph. 3 Alph. 4 Alph. 5 
NA x AD D EM 
KZ ou F TNW ITJ 

E E K AFN 
Q A 
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Family ‘‘F” is tied into the diagrams through the observed relationship of REF in Alphabet 5 which is 
tied into the EF already in the diagram, establishing the direction of Family “F” as _|2. The other 
1 

families are soon tied in; Alphabet 3 is reconstructed in its entirety, while the other four alphabets are 
recovered with only two or three blanks, after all the relationships present in the columns have been 
exhausted.® 

f. The 25 alphabets recoverable from the 40 lines of matched plain and cipher are the following: ® 
(The ringed letters could be recovered from other messages in the same key.) 


1ABCEIGD@FVUYMHTQKZOLR@S P@N 
2,AQMDEHFIJKTLMOUVYG@NPQXRWSB 
3. ADKOMJUBGEPHSCZINXFYQRTVWL 
4,.AEDC@IFGJHLK@MRUOQVPTNWY@ZS 
5. AFN@UK@OPITJBRHCYSLWEMZ@XG 
6. AGPOCI@LURNDYZHW®JIS@FKVMET 
7 AHXJEZBNIKPVROGSYDULCFMQTW 
8B. AITHPJOBW®MCVF@LQERYNSUMGTDX 
9. AJdaSKQOIVTZEFHGYuNLPMBXWCR 
10. AKELBDFJGHONMTPRQSVZUXYWIC 
1l,. ALTMSXVQPNOHUWDIZYCGKRFBEJ 
12, AMNFLHQGCUJTB@P@KXKIS@DVEWO 
13. ANC@ILDHB@KGXUZTSWQYVORPFE 
144,.A0DWPKJVIUQHZCTX@LEGNYRSMF 
15. APBVHIYKSGUENTCXOWFQDRLJZM 
16. AQMNUBTGIMWZRVLX@@HDEOKFPY 
17. ARMYOFTHEUSZJXDPCWGQIBKLNV 
18. ASDMCNEQBOZPLGVJRKYTFUIWXH 
19. ATOJYLFXNGWHVCMIRBSEKUP@@®Q 
20. AUTRZXQLYIOVBPESNHJWMDGFCK 
21.AVNKHRGOXEYBFSJMUDQCLZWTIP 
22, AWVSFDLIEBH@NRJIQ@GMXPUCOTY 
23. AX®MWREV@TUFOYHMLSIQNJCPGB® 
24.AMIPXMVKBQWU@LOSTECHNZFRID 
-AZDNB@HYFWJILVGRC@MPSOE@TKI 


5 It would be excellent practice for the reader to reconstruct the first five alphabets—and, for that matter, all 25 of 
them—following the procedures exemplified in the foregoing subparagraphs. 

8 These are actually the alphabets of the U.S. Cipher Device, Type M-94, in their original order and at the correct 
decimation. 
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47. Analysis of cryptograms involving known alphabets but with unknown keys.—«. After the 
alphabets have been recunstructed, all messages which are in the same key (i.e., using the same order 
of the strips as just recovered) can now be read automatically. Subsequent key changes involve a per- 
mutation in the order of the strips, and for the analysis of messages in other key periods we must first 
construct 26 charts called “synoptic tables” which will facilitate our work. These tables are nothing 
more than generatrix diagrams based on the original recovered strips arranged vertically, in which the 
top rows of the tables consist of the strips aligned to all A’s, all B’s, etc., as shown in fragmentary form 
for the first two tables below: ’ 

Synoptic Table for A 








1 2 3 4 6 6 7 8 § 10 11 12 13 14 15 16 17 18 19 2 21 22 2 2% 2% 
O AAAAAAAAAAAAAAAAAAAAAAAAA 
1 BCDEFGHIJKLMNOPQRSTUVWXY2Z 
2 CDKDNPXHDETNCDBJIMDOTNVKJD 
3 EEOCQOJPSLMFJWVNYMJIRKSWPN 
4 THMBUCEJKBSLIPHUOCYZHFRXB 
5 GFJIKIZOQDXHLKIBFNLXRDEMU 
* * k k * kK * 
25 PWVXVMQTWWBEPSJFLWDFTOGRT 
24 WSWZXETDCIEWFMZPNXZCITBIK 
2 NBLSGTWXRCJOEFMYVHQKPYZDI 
Synoptic Table for B 
1 2 8 4 6 6 7 8 9 10 11 12 13 14 15 16 17 18 19 2 21 22 B Ww 2 
O BBBBBBBBBBBBBBBBBBBBBBBBB 
1 CAGIRIJINWXDEYMLVTKOSPFHZQU 
2 ECEFHSIKWFJIPKEHGLZEESKAWH 
3S IDPGCQKCCJVAZGGIINPKSJNKXUY 
4 GEHJYFPVRGLKXNYMVLUNMRKGF 
5 DHSHSKVFAHTXKUYKWAGPHUJIWLW 
* * ££ ek K Kk * 
23 WRMEIZJIPLKKULCMJIGNMIXLCMZ 
24 NWJDTHEJPERJDTANQEIOEIPVD 
2A ASUCJWZOMLFTHXPUIQRVYEGKN 


(The small numbers on top are the strip numbers, while the large numbers at the side are the generatrix 
numbers.) 

b. Let us now assume that we have at hand the following cryptogram enciphered by a different 
permutation of the strips that we have recovered, and that the first word of the underlying plain text 
is DIVISION: 


CTYNO JLTDP LRSZJ ZUUWH IOWSY 
JQJZG OZTSH EXPEO VDEYA ILQVM 
LZUII WDCKW SOJIW ZGMSZ RHGYD 
GZRVK MYSZR TPWYE QQCTF FBVLS 


Our first step will be to determine the possible generatrices for the encipherment of DIVISION as 
CTYNOJLT. If we refer to the synoptic table for the letter D, we can see that D may be enciphered as C 
on generatrices 1, 2, and 3, but not by 5 through 8, nor by 10, 15, 18, 21, or 24. Similarly, referring to the 
synoptic table for the letter I, we find that I,=T. is possible on all generatrices except 4, 5, 9, and 21. 


7 The complete synoptic tables are given in Appendix 2. 
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This process is repeated for all eight plain-cipher equivalencies of the encipherment of the putative 
crib; the results are shown in Fig. 73, below, wherein the x’s indicate the generatrix possibilities for the 
eight encipherments. It will be seen that the correct generatrix must be either 1, 12, 19, or 25, since 
all the letters of the encipherment of the initial crib must necessarily come from a single generatrix. 


DIVISION 
CTYNOJLT 


losxexxxxxxx 
2xxx*XxX xx xXx 
3 XXX xXXXX 
4x xxxxx 
5 XXX xx 
6 XxX Xx xXx 
q XKX X 
8 x xX xx 
9 x xx xxx 
10 xX xxXxx 
ll xxx xxx 
12 xxxxxXxXXX 
13 sxx «x x 
14 xx xx 
15 x «x x 
16exxx xxx 
17 xxxxx xx 
18 Xxx x «x 
19 xxXKXXXxXxX 
20 xX xxx xXx 
21 XXKXXXX 
22 xxXxX XK xxx 
23 xxxx x 
24 x xxx 
25 xxxxxXxxx 
Ficurr 73 


c. The next step is to consider each generatrix in turn, and determine which strip or strips can give 
rise to the particular encipherment on that generatrix. For example, in taking generatrix 1 into consid- 
eration, we find from the synoptic tables the following possibilities for strips: 


DIVISION 
CTYNOJLT 


45 @) 3 23(@)1 1 
Generatrix 1 is impossible, because we cannot have strip number 2 in two positions since the permutation 
of strips does not admit of any repeated elements. Likewise, generatrix 25 is ruled out because of repeated 
unique strip numbers: 


au 
R)sH 


. 


VISION 
YNOJLT 
180" 
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The strip permutations (with multiple possibilities) for generatrices 12 and 19 are shown below: 


DIVISION 
CTYNO 


Gen. 12:7 # %2 3 
DIVI 0 

CTYN L 

Gen. 19: § 2° § OP HY 


ole, 
o |r 


Note that in the strip possibilities for generatrix 19 we have crossed out a 5, 10, and 19 from some columns 
since these numbers are uniquely represented in three other positions. 

d. Generatrices 12 and 19 both admit of 8 possibilities of strip arrangements, so we shall try the 
former first. We first try the strip order 3-17-16—2—8-6-9-20 and, searching in the other three lines of 
cipher text for plausible plaintext fragments, we arrive at the results shown in Fig. 74a, below. The 


317 16 2 8 6 9 @ 31716 2 8 6 9 2 317 1614 8 6 9 @ 319 16 14 8 6 9 2 
CTYNOJLT CTYNOJLT CTYNOJLT CTYNOJLT 
DIVISION DIVISION DIVISION DIVISION 
JQJZGOZT JQIJIZGOZT JQIZGOZT JQJZGOZT 
DPPUNTOC DPPUNTOP DPPINTOP DUPINTOP 
LZUIIWDC LZUIIWDC LZUIIWDC LZUIIWODC 
EBLGFTFY EBLGFTFL EBLEFTFL ENLEFTFL 
IRERYILE IRERYILN 

GZRVKMYS GZRVKMYS GZRVKMYS GZRVKMYS 
NQERRIWE NQERRIWK JEMPOFFA JUMPOFFA 
JEMMOFFB JEMMOFFA 

(a) (b) (c) (d) 
Fieure 74 


cipher JQJZGOZT yields DDPUNTOC as an interesting possibility; the cipher LZUIIWDC yields EBLGFTFY 
and IRERYILE that contain plausible plaintext fragments, while cipher GZRVKMYS yields NQERRIWF and 
JEMMOFFB among other generatrices containing fragments of what may be plain text. We now change 
the strip number 20 in the last position to its other variant, 22, and we see what the strip order 3-17-16— 
2-8-6-9-22 gives us; the results are shown in Fig. 746. Changing the fourth strip (number 2) into its 
variant, 14, improves matters, as shown in Fig. 74c; and finally when we change the strip in the second 
position (number 17) into its variant,-19, so that the strip order now reads 3-19-16—14~8-6-9-22, we 
get valid plain text all the way across the generatrices, as shown in Fig. 74d. 


e. The continuation of the third row of Fig. 74d seems to be the word FLANK; when this is assumed, 
the word POSITION emerges in the second row of the cipher text, as is shown in the decryption below: 


3 19 16 14 8 6 9 22 1 2 10 4 20 17 15 
CTYNO JLTDP LRSZJ ZUUWH IOWSY 
DIVIS ITONre serve 
JQJIZG OZTSH EXPEO VDEYA ILQVM 
DUPIN TOPos iTION 
LZ2UII WOCKW SOJIW ZGMSZ RHGYD 
ENLEF TFLAN Kstop 
GZRVK MYSZR TPWYE QQCTF FBVLS 
JUMPO FFAtn oonas 
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At this point it might be noticed that the key exhibits isomorphism beginning with the 12th element: 
this is the result of the use of an 11-element basic key (with a literal key probably underlying the key 
numbers) expanded to the required 25 elements. Thus the complete key may be recovered as in the 
following diagram: 

3191614 8 6 9 22 1 24 10 

420 17 1511 7 12 23 2 25 13 

5 21 18 


When this key is tried, it is found that the entire message can be read. A numerical key of the numbers 
of the top row of the foregoing diagram is made, and when this simplified basic key of 2-9-8-7-4-3-5- 
10-1-11-6 is analyzed,® it is found to be based upon the word CONFEDERATE, and the method of key 
production by the cryptographer was probably the following: 
5 10 15 20 
CONFEDERATECONFEDERATECON 
319 16 14 8 6 9 2 1% 10 4 M17 1511 7 1B 2 1B 5 
jf. The preceding case exemplified the exploitation of a crib whose position was known or assumed. 
In the next example we shall assume that the cryptogram below contains the word HEADQUARTERS, 
but that its position in the message is unknown: | 


AENLV DCBJQ JMTFE BJGLP AQKOT 
ZPCRU JJZPN VXPTC ZJEFK HSLIL 
WRZGQ YIYSQ RRDHV SCLHZ CWGLW 
ZPRTQ KBLKK NNAIS WEAFZ AOAOA 
Our first step is to determine the location of the crib. We could take advantage of the noncrashing 


properties of a strip cipher system, but there still would be too many possibilities for the placement of 
the crib; the property of the limitations of the cipher equivalents for plaintext letters on each generatrix 
will therefore be used. Since we do not know the generatrix involved, we shall first assume that it is 
number 13, and then, if this is unsuccessful, we shall try 14, 12, 15, 11 . . . in turn, until we have 
determined the correct generatrix. 

g. In the alphabets of the M-94 there is a considerable limitation in the cipher equivalents of plain- 
text letters on all generatrices, except for generatrix numbers 1 and 25.° For example, in the synoptic 
table for A, we find on the 13th generatrix no occurrence of the letters A, B, D, E, F, I, J, K, M,N, or 
Q. If we were to make diagrams of the impossible cipher equivalents for the letters in the word HEAD- 
QUARTERS, on let us say, generatrix numbers 13 and 20, they would be the following: 


Generatriz 13 Generatriz 20 
HEADQUARTERS HEADQUARTERS 
CAAAACABGABC BBADCBAABBAA 
HEBBDDBCHECD EDBFGCBCCDCC 
JIDDGFDHLIHE HEGGHEGDLEODD 
KLEIHGEKNLKF MFHJIGHJOFJH 
NMFNMHFLTMLG QGSKMKSKPGKM 
PNIPOLIOUNOK WJITLNLTLTJILP 
QPJQQMJIRZPRN YNWMQNWMVNMR 
RSKSUOKxX Ss xX 0 RXOUOXNXRNS 
TVMUZQM V P YQOwS YQZ Q Xx 
UYN TN Y Ss ZT TZR R 
XxX Q U Q u UU U 

X W Y Y 


8 For the method of derivation of literal keys from numerical keys, see pp. 427-429 of Military Cryptanalytics, Part IJ. 

* These alphabets have been specially constructed so that the smallest number of repetitions of pairs of letters would 
occur; in the 25 sequences, the only digraphs appearing twice are DE, YA, and UB. Nevertheless, there are manifold 
occurrences of skip digraphs (A-B, A—B, etc.) at wider intervals. 


— SECRET 160 





—~SEGRET. 


If we now start with the first letter of the cipher message, we can rule out every possible placement of 
HEADQUARTERS on the 13th generatrix, by tracing the successive letters of the cipher text against our 
limitation diagram and finding conflicts. 

(1) Having eliminated the 13th generatrix for the encipherment of our crib, we now try the 14th 
generatrix and we get only one possible placement, at position 77: 


80 


Q 
D 


90 


a AIS. 
5 


ee 


RT K BLK NN 
EA QUAR ER 
This placement admits of the following possibilities for strip arrangements for the 14th generatrix: 


See 
Gen. 14: PRTQKBLKKNNA 


4 2 7 16 18 10 2 11 3 
1s 3s 5 B 


None of the 16 possible arrangements yields plain text in corresponding positions of the other lines of 
25 cipher letters; therefore the apparent placement of the crib at that position in the cipher and with 
the 14th generatrix must have been an accident. 

(2) The word HEADQUARTERS could fit at position 39 on the 11th generatrix giving a multiple key 
of 24 possible strip arrangements, but this placement too is an accident. Unique strip arrangements 
are then obtained for the placement of the crib on the 25th generatrix at positions 21, 26, and 88; and 
we also obtain a unique strip arrangement for the placement on the Ist generatrix at position 62. Since 
none of these keys yields valid plain text on the other cipher lines, all of them must be accidents. On 
generatrix 3, the crib fits at position 85 with the following multiple key which yields a total, not of 288, 
but of 72 permissible arrangements: 


HEADQUARTERS 
Gen.3: KNNAISWEAFZA 
1 7 16 19 2 13 3 11 8 16 15 14 
82 23 12 21 21 2 

1524 ye 


None of these bears fruit, so we are left with the unmistakable conclusion that, having made a large 
number of trials thus far, if the word HEADQUARTERS is present in the cipher text at all it must be divided 
between two lines on two different generatrices. 

(3) If HEADQUARTERS is divided between two lines, it must begin somewhere between the 15th 
and 25th positions of each line of the message except the last. [t cannot begin at position 15, because 


15 


EB 
HE 


a 
was 


JGLPAQKOTZ. 
ADQUARTERS 
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of the crashing plain and cipher text, nor for the same reason can it begin in 12 other positions in the 
range specified; thus there are only 20 positions left to try. The first trial, assuming that the crib begins 
at position 16, is shown in Fig. 75a, below, and it is seen that generatrix numbers 14 and 25 are the 


Crib at position 16 Crib at position 20 
HEADQUARTERS HEADQUARTERS 
BJGLPAQKOTZP PAQKOTZPCRUJ 

l1 xxxxx xxx x|x x 1 xxxxxxix xxxxx 
2 x x xX x 2 x x xX X x x 
3 x x xX X/|x 3 xxXxXxXxX x x 
4 xx x x X xX/xX x 4 x X XIX X x XxX 
5 xxx xxxx x 5 xxx xx|x x xxx 
6 xxx x Xx x x x 6 xx xx x x x Xx 
7 xxx x xxx x 7 x xX x x 

8 xxx xxx x X|xX 8 xx xx x xx 
9 xxxxx xx x 9 xxxxx x 
10 x x xxx xX x x 10 x xxx xx xX xX 
ll xxx x|x ll sxx x x xx xXx 
«xxx x x x x 12 sxx x xxx x 
13 sxxxxxx xX X/X 13 x xxxxxx 
144xxxxxxxxxx x 14 x x xxXXXXX 
15 xx xxx x x 15 xxx xx xxxxxy 
16 xxXXXxXX jx x(|x x 16x x xxix x xx 
17 x x x x 17 x x X/X xx xx 
18 x xx xX x{x 18 xX XXX x xxx 
19 x x x x x 19 x x x X|x xX x x 
20 x x xX x|x 20 xxx x x x 
el x x x x x x 2l xx x x x x 
ee xxxxxx xXx xX/x 22 xx x xix xx 
235 x x xxx |x x 235 xxxxxx| xxx 
24 x x x x xX X{x x 24 x xix x xX xx 
25 xxxxxxXxX XxX X/x x 25 xxxx xxix xX xxx 

Figure 75a Fieure 75b 


only ones with x’s all the way across to the vertical line marking the end of a line of 25 cipher letters 
of the message.’° Fig. 758 shows the second trial, assuming that the crib begins at position 20 with the 
letters being split 50-50 on two cipher lines; the first six letters could involve generatrix numbers 1, 
23, or 25, while the last six letters could involve generatrix numbers 1, 13, 14, 15, or 25. Both of the first 
two trials come to naught, since the keys derived do not yield plain text in other parts of the message. 


10 As mentioned in the previous footnote, these particular alphabets have been constructed so as to achieve the 
maximum variety of consecutive digraphs among the 25 sequences, therefore in the M-94 alphabets generatrix numbers 1 
and 25 will almost always be present as possible candidates. If the alphabets had been constructed by a truly random 
process, these generatrices would be present no more frequently than any other generatrix. 
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(4) After very considerable and laborious experimentation involving several hundred trials, we arrive 
at the placement of the crib at position 72 as shown in Fig. 75c, below: 


HEADQUARTERS 
WGLWZ2PRTQKBL 


XXX 


l1xxxx|x xxxx 
2 xx x 

3 xxx x|x x xxx 
4 x x xx xXX 
5 xxx xix x xxx 
6 x xX x x x 
7 x x x|x x 
8 x x|x 

9 x x|X XXX 
10 xxx x x x x 
ll x X X/X x x 
12sxxx x xX xX x 
13 xxx x xxx x 
14 x x x x 
15 x x 

16 xx xxx 
17 x x x x x x 
18 xxx x|x x x 
19 x x xK/x x x 
20 x xxx xx 
21 x x x x x 
22 xX X|X Xx xX xX 
235 x X X|X xxx 
24 xx x|x x x 
25 xx xX x|x xX xXx xX 

Figure 75c 


x 
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x 


x 
x 


“ 
mM OM OM OM 


mM mM OM OOM 


* 


x 
x 


Ed 


Since the longer fragment QUARTERS has been enciphered on one generatrix, at the beginning of the 
fourth line of the cipher, we shall consider this portion first. The generatrix possibilities are generatrix 
numbers 1, 3, 20, and 25, so we derive the multiple keys shown below: 


Gen. 1: 


Gen. 20: 


QUARTERS 


ZPRTQKBL 
2 W173 1 5 


Gen. 3: 


Gen. 25: 


QUARTER 
ZPRTQKB 
eo ES? 


T 


Birt 


n 


Q 


1 


= 
Bru 

~ BA 
8 


IN 
ol > 
cS a 
olOI 
r 


7 1 


° 


Generatrix 1 is eliminated at once, and the possible strip arrangements for generatrices 3 and 25 do not 
decipher the text; this leaves generatrix 20 as the sole candidate, albeit in 28 possible strip arrangements. 
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(5) After several trials, it is found that the order of the first eight strips is 3-10—12-16-6-21-7-14, 
yielding the following decipherments on the 8th, 4th, 13th, and 20th generatrices (as measured from plain 
to cipher): 


3 1012 16 6 2 7 14 
AENLV DCBJQ JMTFE BJGLP AQKOT 
FURTH ERT 
ZPCRU JJZPN VXPTC ZJEFK HSLIL 
POLIC YWI 
WRZGQ YIYSQ RRDHV SCLHZ CWGLW 
HENEX TFI HEAD 
ZPRTQ KBLKK NNATS WEAFZ AOAOA 
QUART ERS 


The rest of the text is easily read, the complete order of strips established, and the basic 14-letter literal 
key recovered, as shown below: 


_ 


5 
NDRYCHINE 
17 5 0 3 4 M13 18 8 


25 
ELAUN 
9 2 24 


15 9 


& EE] on 
8as 
BMS 


CHIN 
3 


10 12 16 


SELA 
7 1 


21 14 


_ 


h. The example in subpar. 5 was solved by means of a placed crib. If instead of a crib we had a pair 
of isologs available, we could treat the first line of 25 letters of one message as if it were the plain text 
of the other and arrive at an easy solution. Even if we had isologous beginnings of a pair of messages, 
solution could be effected in the manner of a placed crib. As an illustration, let us assume that we 
have at hand the message given in subpar. 6 and another message, both of which are suspected of begin- 
ning with the same unknown initial stereotype of unknown length. The two message beginnings are 
shown below: 


"A": CTYNO JLTDP LRSZJ ZUUWH IOWSY. 
"B"; PZ2KLH HYUYR XWIHV YMNIC NAFUG. 
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We now construct a diagram for establishing generatrix possibilities, and we test the message beginnings 
to see if they could contain identical underlying plain text and for how many positions; this is shown in 


Fig. 76, below: 


soar. Cc 
(eB. P 
l x 
2 
3 x 
A 
5 
6 x 
7 x 
8 x 
9 x 
10 
ll x 
12 
13 x 
14 
15 x 
16 x 
17 x 
18 x 
19 x 
20 x 
2l x 
R22 
25 xX 
24 x 
25 x 


5 
TYNO 
ZK LH 
xX XXX 
x xx 
xx Xx 
x XX 
xx xX 
xx Xx 
x xx 
x xx 
x x xX 
x x xX 
xXx xx 
x xX xX xX 
x 
x x 
x x 
x XX 
x XX 
x xX 
x x 
x x 
x x 
x 
x xX XX 
x 
x XxX xX 


10 
JLTDP 
HYUYR 
xX X XX X 
x X XX 
x Xx XX 
x X X 
xX X x X 
x X x X 
x X XX 
x x x 
x 
xX X XX 
xX x 
xX xX xXx X 
x X 
x x 
x 
xX X X X 
x x 
x x X 
xXx X X X X 
X XXX 
x x x 
xX X X x 
x X X x 
XX X 
KX XX KX 
Figure 76 


or 
aa 


HM 
<=N 


a 45 


It may be seen that, if the messages do contain identical beginnings, these beginnings are probably 
no more than 8 letters in length, because in generatrix 23 there is only this number of consecutive x’s 
before an impossibility arises. The following thus are the possibilities for strip numbers for the three 
generatrices that come into question: 


Gen. 1: 


Gen. 23: 


e 
p 
bo 
on 


au. 


8 


of OQ 
SIN 4 


VQ 
N'A 
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Bix onl 
Cz seoltt 2 © z 


© 
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Generatrices 1 and 25 are eliminated immediately because of repeated unique occurrences of strip 
numbers, leaving only generatrix 23 to be considered. The solution from here proceeds as in subpars. 
d and e, except that instead of only 8 possibilities of strip arrangements, there may be 45 possible trials 
before the correct arrangement is found. 

48. Further remarks.—a. The Bazeries device incorporated 20 systematic 25-letter alphabets, 
including the normal and reversed normal sequences, and 14 keyword-mixed sequences. The alphabets 
of Hitt’s device, as already indicated, bore many interrelationships, constituting a cryptographic weak- 
ness. For example, in the synoptic table for A, no generatrix contains more than 10 different letters, 
and several contain as few as four; moreover, some of the generatrices contain one letter 20 times: all 
this greatly facilitates crib placement. The M-—94 alphabets devised by Mauborgne were intended to 
be as diverse as possible, but the diversity did not extend beyond digraphs; and since the only digraphs 
occurring twice are DE, YA, and UB, he originally called his system the DEYAUB cipher. 

b. In Bazeries’ device 24 cipher generatrices were possible, but he prescribed that the first two and 
last two should not be used; thus there were only 20 generatrices available. In the M-94, which used 
a guide bar along which to align the plaintext letters, the 1st generatrix was completely hidden, while 
the 2d generatrix was half hidden, so that these generatrices could not be used; conversely, the 24th 
and 25th generatrices were not to be used, because these could not be seen when the cipher text was 
set up along the guide bar. With strip cipher systems, no limitation of generatrices exists—-except of 
course for the 26th generatrix, which is the same as the 6 or plaintext generatrix. 

c. The cryptograms produced by a cylindrical cipher device or a strip cipher system are non- 
crashing, i.e., a plaintext letter can never be enciphered by itself. Since the 25 cipher equivalents of any 
plaintext letter are equiprobable, the theoretical ciphertext frequencies for English underlying text can 
be computed, resulting in the following distribution: 





A 3.70 G3.94 L 3.86 Q3.99 V 3.94 
B 3.96 H 3.86 M 3.90 R3.70 W 3.94 
C 3.88 I 3.70 N3.68 S$ 3.76 X 3.98 
D3.83 J 3.99 035.70 T 3.63 Y 3.92 
E 3.48 K 3.99 P 3.89 U 3.90 Z 4.00 
F 3.88 100.00 


The y LC. of the cipher text is most easily computed by the formula y=1+ eae where @, is the bulge 


of the I.C. of the plain text (i.e., y—1.00) and ¢ is the number of categories; therefore vals 
1.0012. A property of such systems is that, if the distribution of the cipher letters is made in the descend - 
ing frequency order of the plaintext letters of the language, the slope of frequencies of the ciphertext 
letters will be that of a gradual ascent; thus: 


E 3.48 I 3.70 C 3.88 Y 3.92 X 3.98 
T3.63 8S 35.76 F 35.88 G3.94 Q 35.99 
N 3.68 D3.83 P3.89 W3.94 K 3.99 
R 3.70 L 3.86 U 3.90 V 3.94 J 3.99 
03.70 H3.86 M 3.90 B3.96 Z 4.00 
A 3.70 100.00 


The slope is so gradual that usually about 8000 letters are required for a positive determination of a 
noncrashing system. 

d. In the example given in subpar. 46a the unknown alphabets were reconstructed by means of a 
long cipher message and its compromised plain text. The alphabets could also be recovered if we had 
available a long pair of isologs, even if the underlying plain text were unknown—in fact, even if the lan- 
guage were totally unknown! In this case, the cipher of Message ‘“‘A”’ could be treated as if it were the 
plain of Message ‘‘B’’, and solution would proceed as outlined in par. 46. 
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e. In the absence of either matched plain and cipher or of isologs, the modus operand?, albeit very 
_laborious, is as follows: First, lines of cipher text enciphered by the same generatrix must be established, 
‘initially on the basis of polygraphic repetitions of at least tetragraphs between them. Second, further 
lines of cipher are added, on the basis of coincidences between the lines under consideration and the 
family of lines already established. For example, if we are testing a new line against a homogeneous 
family of six lines, we should expect. .0667<25X6=9.9 coincidences if the new line really belongs to 
that family, as against .0385%25x6=5.7 for random. Third, some plain text must be assumed, either 
for the repetitions or for possible initial stereotypes. Finally, the assumed plain text is tested against the 
other lines of the same family. 

f. The first solution of a cylindrical cipher device was accomplished by the Marquis Gaétan Henri 
Léon de Viaris, who in 1893 described his analysis of the Bazeries device in what is one of the most brilliant 
feats of cryptanalysis in history, in view of the state of the art at the time.’ De Viaris assumed posses- 
sion of the device, a premise granted by the inventor, and he asked Bazeries for three test situations: 
(1) a eryptogram with the generatrix numbers indicated for each line of cipher; (2) another cryptogram 
in which one word of the plain text would be given; and (3) three cryptograms with the only information 
that they are in the same key. The first test case was academic, since in practice a cryptanalyst would 
never know the generatrix numbers, and de Viaris solved this easily by means of synoptic tables of 
which he was the inventor. In the second problem he dragged the crib OFFICIER through the cipher, 
placing the crib correctly on the basis of ciphertext limitations, testing all 20 possible generatrices, and 
recovering the order of all the disks.”? In the third situation he pondered the problem, toying with the 
idea of dragging possible cribs such as the endings EMENT and ERAIENT through the cipher texts, until 
he hit upon the thought that perhaps one of the messages began with the definite article LES. When 
he tried LES at the beginning of the second message, he obtained DES and LAV as the beginnings of the 
first and third messages. He expanded LAV first into LA VUE and then into LA VITESSE, which yielded 
DES PARCS A . . . and LES APPROV . . . in the other two messages; he expanded the latter into LES 
APPROVISIONNEMENTS which yielded DES PARCS AEROSTATIQUES and LA VITESSE D’ UNE COLONNE 
and the problem came to a quick end. De Viaris not only obtained the numerical keys for the three test 
cases, but he also devised the procedure for recovering the literal keys on which the numerical keys 
were based. 

g. The method of-expanding a short key into a longer one was proposed by Bazeries for his device, 
and this method of key construction was prescribed in the instructions for the use of the M~94. The 
weakness of such a scheme can be demonstrated in connection with the partial key of eight elements 
recovered in subpar. 47d: 3-19-16—14-8—6—9-22. If we had encountered difficulties in assuming further 
plain text, and if an expanded key had been used, we could recover the entire key in the following way. 
If the basic key length is 9, then key number 1 must of course be in position 9, and we can also insert 
in the second and third cycles the key numbers shown: 


5 10 15 20 25 
3190614 (8) 6 922 1] 420171510 71123 2] 5 21 184612 @)13 


Since conflicts (indicated by the ringed numbers) arise, the key length cannot be 9. If the key length 
is 10, we know that the digit 1 must be in either position 9 or 10, and we can fill in the following manda- 
tory values: 


10 15 


5 20 25 
319@614 8 6 922 . .}4201715 . 7. . . .)5211808 . 


"! Marquis de Viaris, L’art de chiffrer et déchiffrer les dépéches secrétes, Paris 1893. 

12 De Viaris suggests that 20 clerks be employed for the generatrix testing, one for each of the generatrices permissible 
in the Bazeries device (‘‘Notons en passant que ce travail d’essai pourrait étre fait par 20 secrétaires examinant chacun 
Vhypothese d’une des 20 génératrices du cylindre”’). Actually, if we consider the amount of work we had to do in solving 
the case given in subpars. 47f and g, this might not be such a bad idea. (The De Viaris suggestion antedates the con- 
temporary ‘'1,000,000 Chinamen” allusion.) 
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Since there is a conflict between the 16’s at positions 3 and 24, we rule out a key length of 10 and try a 
length of 11, filling in the automatic values: 
5 10 15 20 25 


3191614 8 6 922 . . .j}4201715 . 7... . .) 5 21 18 


Since no conflicts developed, we can take it that the basic key is probably 11 elements long, and that 
therefore the first cycle must contain the numbers (1, 10, 23), (1, 10, 24), (1, 12, 23), or (1, 12, 24) in 
one of their six possible permutations. We could now try the 24 possible keys on the rest of the cipher 
message to discover which is the correct one, or we could reduce the first cycle of each of the 24 keys 
to a basic key and recover a key word from the correct one. The only key from which a plausible key 
word can be derived is 
Key: 3.1916 14 8 6 9 22 1 24 10 
Basic: 2 9 8 7 4 3 510 111 6 


which is found to be based upon the word CONFEDERATE, so the entire key must be 


5 10 15 20 25 


CONFEDERATECONFEDERATECON 
8 6 9 22 1 4 20 


3°19 16 14 24 10 17 15 11 7 12 23 2 25 13 56 21 18 


h. In subpar. d, above, it was stated that alphabets could be reconstructed through the use of isologs, 
even if the underlying text were in a language totally unknown. Furthermore, once we are in possession 
of the alphabets, even if their order is initially unknown, isologs would make it possible to recover the 
plain text by establishing the order in toto of the strips, following the procedure demonstrated in subpar. 
47h. We would then search the generatrices for the one row in each set that gives evidence of being 
plain text of some kind, either by the distribution of vowels and therefore the pronounceability of the 
text, or by repetitions or other attributes expected of a language. We shall give below a striking demon- 
stration of this possibility of analysis, involving the encipherment of an intermediate text of unknown 
composition. 

(1) The following two intercepted messages were known to have been enciphered with the M-94: 


Message ‘‘A” 
DIIWZ LEXLU DTFNS LMAUE XGYXO 
SELVA ICIJD KKVJQ MKGWVYV KVIDV 
CAMMY QEVEF BICND JMKZH JEGPT 
LWPNC ITOCFH VNRYL FVJGH SHQGA 
Message ‘‘B” 
GDOSF VVRAS BSFPH WEMFW HOAYW 
UYPOD WMYBD 


In the absence of any probable words to try, solution may be very difficult indeed—unless we are lucky 
and, for example, the messages contain identical beginnings in the underlying text. We observe a hit 
between the two messages at their 13th positions, so if they do have similar beginnings these could not 
be more than 12 letters in length. 

(2) We first construct a diagram similar to that of Fig. 73 to test for similar beginnings, and we find 
that this situation is possible on generatrix numbers 7 or 25. We then establish the order of the disks for 
these two possibilities, as shown below: 





DIIWZLEXLUODT 
GDOSFVVRASBS 
Gen. 7: 3 10 12 16 6 4 7 14 +L 9 17 5 
25 15 ft 
19 
21 
DIIWZLEXLUDT 
GDOSFVVRASBS 
Gen. 25: Oi sw Oise 2 OW S 0 x 
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Generatrix 25 is ruled out at once because of conflicts, and we are left with the 8 possibilities of disk orders 
on generatrix 7. We now run down the generatrices on the beginning of Message ‘“‘A” for the positions 
that have unique keys, as shown in Fig. 77a, below: 


3 10 12 16 7140619317 ~*5 

DITWZLEXLUODT 
1 KCSZ ZBRFPJ 
2 OARR BLXOCB 
3 MKDYV NES YWR 
4 JEVL IGPHGH 
5 ULEX KNWMQC 
6 BBWC PYNLTIY 
7 GDOS VRASBS 
8 EFAH RSBIKL 
9 PJMD OMCQLW 
10 HGNE GFENNE 
ll SHFO SAIJVM 
1z2 COLK YOGCAZ 
13 ZNHF DDDPRV 
14 IMQP UWJGMX 
15 NTGY LPFBYG 
16 XPCA CKVZOA 
17 FRUQ FJUAFF 
18 YQJJ MVYXTN 
19 QSTN QIMKHQ 
20 RVBU TUHWEU 
21 TZYB WQTRUK 
ee VUPT AHQESD 
23 WXZG HZKVZO 

LYKI XCZDJP 

AWXM JTOTXI 


Figure 77a 


Generatrix numbers 1, 2, 24, and 25 are ruled out as possibilities for Message “‘A” because of the idio- 
syncrasies of the M—94, and likewise generatrix numbers 5 through 9 for Message ‘‘B’’. To our astonish- 
ment, however, even though we have proved the existence of similar beginnings we are unable to see plain 
text on any of the generatrices. The “plain text,” then, must be some kind of intermediate text. In order 
to assist our analysis, we make generatrix diagrams for the other four lines of cipher text under the 
already recovered key; these are shown in Figs. 77b—-e on the next page. 

(3) In Fig. 77e (the diagram for the last line of Message ‘‘B’’) we note the lettersA QC X..Y XXX 
on generatrix 20; if this generatrix is valid, perhaps null X’s have been used to complete the last group 
of five letters, which would then make this message 32 letters in length. This observation, coupled with 
the length of Message ‘‘A’”’ (100 letters) and the length of the similar beginnings (12 letters), leads us to 
the assumption that the underlying text consists of a 4-letter code. We now note on the 21st generatrix 
in Fig. 77d (the diagram for the last line of Message ‘‘A’’) the sequence of lettersQ)VUP.). IIE)TIV 
which, on the basis of 4-letter code groups, might indicate the presence of another VUPT which had already 
occurred on generatrix 22 of Fig. 77a. Of the two key possibilities (6 and 25) for the 5th column, only 
disk number 6 will produce a T, out of C, on the 21st generatrix. One more column of possible decipher- 
ments can now be added to each of the diagrams of Figs. 77a-e. 

(4) We now take a close look at our diagrams and we examine the putative plain text we have just 
considered : 

In Fig. 77a, generatrix 22: VUPT)R.AH)QESD 
In Fig. 77d, generatrix 21: Q)VUPT). IIE)TIV 
In Fig. 77e, generatrix 20: AQC)XI.Y)XXX 
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ANMY MOK DAMNOANNYMNOLRAHROHAAMNYNH 
Ae ett Nn dA eA KT AT ANNUNNNUNN 
RA BOMETBSINHOZVOAROMNAxMNMEM 
7 HUA RP DH STMHOMNOULHMHNAE 
Sb S&HOARAEFAMHNEPHDODTNLOEMMYA 
+S Eames WNMAHMAP>PMOUNHNNADA 
= -4 
a 
20 UHA@OnZoOMbHOHSENMPYIMONET 
20, MHAMArHAFOACSEZRIAITAUODDH 
Sh OMMAUIMARNXUMOZSHLAANEN 
“D DPUDMNONHS¢MhRHOMH>EWAANO 
“oz MAOMHHHMOMDONANI EH SNE MY 
5 SrHORHDTHDNMNDKHAMOEFUGHMN 
Qo NHAOAZAVOMUUMNAMMEMAPAHDE 
= Ex, METHOMNOUMxHMHNAESAMOWHYS 
sO NMAMUAHMMNSHAONAFANMHESHDS 
~O HMADHTORE CHE ATM HO HANMZHMA 
H 
o 
2 iz, HOHE EN MP UMONTARONMRAH a 
0, MHNMAPHEOASARYATCUOD DH 
oe AMAOMAMRNUMOZSHAMANEND 
J MOBS VD MOUMADNONHAZM REHOME 
oH OAM MONMHIEFH SENS MUAH AZODMA 
5 ZPaIMSrHOhHeHTAINANWDXHADOEY 
R fe, TMEANHOZVOMUOMNAMM EO EDA 
= fe] ALP ODO mNSTHOMNOYNMHMHNAE AS 
x CMNOHPMMANMUAHMMNESE RA ADAOAFA 
fx] ZHMAPFMOUNHADHOLRESE CHEAT 
> 
2s Cr>dIXONTMANONMNRANRAOHZDME 
as HECOODTHMHANMMHAMA>P AE 
Qe AMAKRVUDMOBAZSHAMONENDHMME 
0 & Zoe kaHOmMHr>PEWIMANOBHDMUAA 
oh BHHEOAGMMONMNHNIEFA ENP KOR S 
7 PIM SrHORHTHWDNYNDHANMODEUSD 
Ra mROnAMSANHOZNVOAUMNAMNMN EE 
“hy DH SMDHONMNNOUMMNAESAAMODH 
SH TNOHSMMUIMUBZHMNESE HR TAOQEAM 
ro CHEA MMHORINMZHMAPMOUNHA 
He 
< 
2 ONTAMOMRANDAOHRZDMHOUHSEE 
9 BOD SHMHANMHMHNMAPHE OCS 
g ARNVUOMOSZSSHAMONEPNDMHMEHOD 
«o U HZMkRHOMHP EWA ANMNOZ HD DMO 
ANMYNOKRDAHDOANMNYNOKDHDOHANYI 
AAA TA TA ATR AANNUNUNANN 
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Figure 77e 


Figure 77d 


Figure 77c 


FIGURE 770 
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‘It certainly looks as if the underlying code groups have the consonant-vowel pattern of CV—. On this 
. basis, the correct values for the blank 6th column of our diagrams (with multiple keys of 4, 15, 19, and 
21) can now be determined, since the second code group at the beginning of Message ‘‘A”’, R-AH, should 
have a vowel in the second position. The only disk that satisfies this condition is number 21; thus we are 
able to arrive at the following correct decipherments of the lines of cipher in the two messages: 


Message ‘‘A”’ 


3 10 12 16 6 2 7 «14 «1 «23:17 5 
DIIWZLEXLUDTFNSLMAUEXKGYXO 
VUPT)RUAH)QES D) ) ) ) 
SELVAICIJDKKVJIQMKGWVKVIODV 
IDG)COVQ)HUF V)P ) ) ) 
CAMMYQEVEFBICNDJMKZHJIEGPT 
WN)BEMK)JSETOC)TE ) ) ) 
LWPNCIOCFHVNRYLFVJGHSHQGA 
QVUPT)CIIE)JTIV ) ) ) } 
Message “B” 
3 10 12 16 6 267 14 «1 «8 WT 5 
GDOSFVVRASBSFPHWEMFWHOAYW 
VUPT)RUAH)QES D) ) ) ) 
UYPODWMYBD 
AQC)X IU Y)X XX 
FiIGuRE 78 


(5) At this point we have only nine code groups established in the code of the underlying text, as 
follows: BEMK, CIIE, COVQ, HUFV, QESD, RUAH, SETC, VUPT, and XIUY. Armed with this small sample 
of the total code population, we are nevertheless able, with a little experimentation, to construct the 
permutation table which gave rise to the these code groups; this table is shown in Fig. 79 on the next 
page. We can now decipher the remaining code groups practically automatically, as will be demon- 
strated. Referring to Fig. 78, the group TIV-in the fourth line of Message “‘A” is shown by the per- 
mutation table to be TIVC, and the only disk number that can be involved which will also give a vowel 
at position 13 of the second line of the message is disk number 2. This yields in the third line the group 
TEI-, which must be TEIR from the permutation table. This general procedure is repeated, recovering 
the key for a column at a time, until the entire key is obtained. The key, on further analysis, is found 
to be based on CHINESE LAUNDRY, expanded to 25 letters. 


13 Actually, we made a slight mistake in the reconstruction of this table. After deciphering all the code groups in the 
two messages and encountering the group ZYAZ and ZYDC which do not fit in our table, we realize that we must have 
made an error in its reconstruction. We now modify it so that the middle portion at the junction of the two matrices looks 











as follows: 
Wie eee eee eee ee eee Ke AETOUY 
oe AETIOUY 
Z|Yerer- ree er eee ee eo er eK eee AEIOU 
ABCDEFGHIKLMNOPQRSTUVWX YZ 
BCDEFGHIKLMNOPQRSTUVWXYZIA 
CDEFGHIKLMNOPQRSTUVWXYZA'IB 





The bottom matrix is a 24X25 rectangle, and not a 25x 25 square as we originally reconstructed it. 
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Nt MoAkRUMHMHSAZOKACMNHDSEE MH 
ANA MOOADROLDTHMHASZOMCOKMNHD SP EM 
MAN AMQOARROUDHNM HAS AOAOCMNADPE 
EMANAMOONDDRODHNMH SE SZONOUMNHDYS 
PE XMAN A MQOOAMkRODHNM HS ZOOM NHD 
PPrPEXMAN AMOAWDUIHMHSSORMGMNH 
HDOPENXNM ANA MOANAAMRUMHMHSZOKROMN 
QNHDPEXKMANAMOOQOAALODHMHASZOKACmM 
MNRDPFEXAYNAMQOOADRUOIOHNMNASE SOND 
OMNHDPFPEXMHNAMOANLUNMHNM YS ZO 
ROMNHDSFEXMHINAMOAADKRUDHM A ZZO 
OCNMOMNHDPF EHANAMOAALRUOUITHMH SZ 
ZOROCMNAD EF EXHANAMOAMEUMDHNMHAS 
SZOAOCMNHDSEEHMANAMOOADLOTDHM YA 
HFA SZOMOMNNHDAP EK AN AMOANDLUMHN 
MHEZOMOMNHDSEFEXMANAMOAHDEL OTH 
HMHSZOMOMNHD PEM ANAMOOANLUTE 
DCHM AS SZONAOMNHDP EH HINAMOADEKY 
ODHMHASZOAOMNNHDPEMHANAMOAMEL 
RUOUDHMHESOMOMNHDP EX aANAMOAR 
HRODTHNM YS ZOMLOMNHDSF ESM HNAMOA 
AMRUOUDHMHASZOROMNHDSP EM HANAMO 
DCAMRODHNMHSESOMOMNHDESP SEMANA M 
MoOADRODHNMNH SE ZONMOMNHDSPEMAN A 
ZAMOOAHKRUDHMHASAZAOMOMNHDS EXMAN 





Figure 79 
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49. Introduction.—a. The earliest cipher devices involved concentric disks rotated by hand in a 
prearranged manner to achieve a polyalphabetic substitution, usually periodic. In some of these devices 
the alphabets, usually standard sequences, were unchangeable; in others, the order of the letters in the 
sequences could be changed at will by the correspondents. At the beginning of this century the hand- 
operated disk cipher devices were improved by the incorporation of gear mechanisms to accomplish 
the polyalphabetic substitution automatically. 

b. The more primitive of these devices produced periodic polyalphabetic substitution—in fact, 
one device marketed commercially produced cryptograms having a period of three (/). Others yielded 
the encipherments of progressive alphabet systems, ciphertext autokey systems, and plaintext autokey 
systems; still others used variable pin wheels to govern the displacement of the components in an ir- 
regular (but periodic) manner. The more sophisticated and interesting devices employing geared disk 
cryptomechanisms are those typified by the Wheatstone cipher device and the Kryha cipher machine, 
and these deserve extensive treatment. 

50. The Wheatstone cipher device.—a. This device, invented by Sir Charles Wheatstone! in 1867, 
is a little more than four inches in diameter, and consists of a dial with two hands, as shown in Fig. 80, 
below. The dial is composed of two independent circles of letters. In the outer circle, which constitutes 
the plain component, the letters progress clockwise in normal alphabetic sequence, but there is an extra 
character between the Z and the A which is used as a word separator, making a total of 27 characters; 
furthermore, the digits 1-6 are inscribed together with the letters A—J and also N—W, for enciphering num- 
bers. In the inner circle, which constitutes the cipher component, the letters are arranged. in a mixed 
sequence and are inscribed either on a surface which permits erasure, or on a detachable cardboard circle 
which can be removed and replaced by another circle bearing a different sequence. 

b. The two hands are pivoted concentrically, after the fashion of the hour and minute hands of a 
clock. In a clock, when the minute hand makes a complete revolution, the hour hand makes \-2 of a 
complete revolution; the action in the case of this device, however, is somewhat different. The short 
hand is free to be set independently of the long one, although the motion of the latter affects the former. 
Since the outer circle has 27 spaces and the inner one only 26, by a simple gear assembly each complete 
revolution of the long hand causes the short hand to make 1%, revolutions, thus causing the short hand 
to point one place in advance of where it pointed at the end of the preceding revolution of the long hand. 
For example in Fig. 80, when the long hand is over B of the outer circle and the short hand points to R 
of the inner circle, if the long hand is pushed clockwise around the dial, making a complete revolution, 
the short hand will also make a complete revolution clockwise plus one space, thus pointing to D. 


1 Credit for the conception of the system described here belongs not to Sir Charles Wheatstone, as is commonly 
thought, but to an American, Decius Wadsworth, who in 1817 constructed a device identical in principle with that described 
on pp. 342-348 of the Scientific Papers of Sir Charles Wheaisione, published by the Physical Society of London in 1879. 
The Wheatstone device used a 27-element outer alphabet and a 26-element inner alphabet; the Wadsworth device used 
a 33-element outer alphabet (26 letters and the digits 2-8, inclusive) and a 26-element inner alphabet. Furthermore, whereas 
in the Wheatstone device only the cipher component could be varied, in the Wadsworth device both components could 
be varied. 
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Ficure 80 


c. To encipher a message, the long hand and the short hand are first set to prearranged initial 
positions, or set according to an indicator procedure; furthermore, by previous agreement, the long hand 
is invariably to be moved in the same direction, usually clockwise. Suppose the message to be enciphered 
is SEND AMMUNITION. The long hand is moved clockwise until it is directly over S on the outer sequence; 
the letter to which the short hand points is the cipher equivalent of S and is written down. Then the long 
hand is moved clockwise to a position over E, and the letter to which the short hand points is noted and 
written down; the next two letters are enciphered in the same manner. After the encipherment of each 
word, the long hand is moved clockwise to the asterisk, and the cipher equivalent of this word separator 
is recorded; when a doubled letter occurs in the plain text, as in the case of the doubled M of AMMUNI- 
TION, some infrequently used letter such as Q, must ke substituted for the second occurrence of the 
letter, and encipherment proceeds as before. To decipher a message, the hands are first set to their 
prearranged initial position, and then the long hand is moved clockwise until the short hand points to 
the first cipher letter; the long hand is then directly over the plaintext equivalent. The process is con- 
tinued until the message is completely deciphered. 

d. The principle of the Wheatstone device can be duplicated with a pair of sliding alphabet strips— 
a 27-element plain component and a doubled-length cipher component. After the two strips are set to 
their prearranged initial juxtaposition, the cipher equivalent is found for the first plain-text letter. 
The cipher component strip is moved one position to the left for succeeding encipherments whenever 
a letter in the plain component 1s located to the left of the immediately preceding plaintext letter of the message. 
What makes the Wheatstone device particularly interesting is that the motion of the cipher component 
is highly irregular and unpredictable, depending as it does upon the particular sequence of the letters 
of the plain text and upon the particular arrangement of the letters in the plain component. At the time 
of its invention, the Wheatstone device was of course considered by the cryptologic world as “absolutely 
indecipherable.” 
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51, Analysis of the Wheatstone cipher device—a. In order to understand the mechanics of Wheat- 
stone encipherment, let us study a cipher message with its compromised plain text, as given below: 


5 10 15 20 25 30 
SLYYI RLMHT QWOAX DCBZR ITJZX FIRIQ 
REFER QING* TO* YO UR*ME SQAGE *NUMB 

35 40 45 50 55 60 
URKLL IROTB XMXPV JQSIV CISZU VIWWK 
ER* ON E* EIG HT* TW O* DAT ED* TW O* ONE 

65 70 75 80 85 90 
AVFQH HHGFW OIBRJ TSBTXK ZUREE DJBGE 
*JANU ARY*C OMQA* GENER AL*¥LU NSFOR 

95 100 105 110 115 120 
EQXBB VSDFT BBZFS GXRBF ILCEJ HDFXM 
D*WIL Q*BE* ARQIV ING*#A T* YOU R* HEA 

125 130 135 140 145 150 
KBVVV FTXGR QJVFF BZ2PYW CKESA MONFN 
DQUAR TERS* AT* ON E* SEV EN* HU NDRED 

(The enciphering components used in this example were the following, 

5 10 15 20 25 27 
P-HYDRAULICBEFGJIKMNOPQSTVWXZ* 
C:QUESTIONABLYCDFGHJKMPRVWXZ 

although at this stage we are not supposed to be privy to this information, which is being given for 


surreptitious reference only.) 

(1) We note that whenever there is a ciphertext doublet, the plaintext digraphic equivalent always 
consists of a pair of consecutive letters in the plain component, but in reverse; thus we can establish 
EF, QS, NO, and DRAULTI as chains from the origina] plain component. We also note that whenever there 
is an A~A doublet in the plain text, the cipher equivalent will be a pair of consecutive letters (without 
reversal) in the cipher component; thus we can establish LYC, IO, MP, VW, ST, UE, and FG as chains 
from the original cipher component. 

(2) We now note, at position 5, that RQI,—IRL,; and since we have determined that the letters 
DRAULI are in sequence in the plain component, it is obvious that in enciphering the plaintext fragment 
RQI,, the cipher component must have moved just once. If the juxtaposition of the plain and cipher 
components at this point is Ry,=I,, then we can arrive at the following graphic representation for the 
distance between I, and L, (adding the 0, and YC, from the chains already established in the cipher 
component) : 

At pos.5,R QI,, . DRAULTI 
IRL, I0...Lyc 


Likewise, at positions 16, 80, and 102 we have the following relationships and recoveries of fragments 
of the cipher component: 


At pos.16, UR, « DRAULTI 
DC, CD 

At pos. 80, RA L,, DRAULI 
X ZU, XZ.Ue 

At pos. 102, RQ I,, «. DRAULTI 
BZF, B Fg 
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(3) Now since ER,—YI, (at pos. 4) =UR, (31) =TX, (79), we can establish (R . . X Z.UES T) 

as one of the chains from the cipher component, in addition to(I 0...L YC Djand(B....F G) 
already recovered. Other relationships are exploited, as follows: 

N G,=X R, (107)=M H, (8), » (H . . M) 

N E,=L I, (35)=W K, (59)=B T, (78), « (KK... . VW) 

T *,=M X, (42), « (MM... . X) 

At. pos. 115, U R,, « DR AUL TI; at pos. 147, DR, . DRAULI 

H, H J ON, ON 


G *,=H T, (9)=R B, (108), tying two of our chains together. 
At this point the several chains can be amalgamated into one sequence, 
HJKM.RVWXZ.UESTION.BLYCDFG 


and the missing values can be recovered from other relationships in the matched plain and cipher. 
(4) In reconstructing the plain component, we begin with the fragment (D R A U L I) and add 
the following relationships: 


SL.=RE, (i), « DRAULI..Ef) 
T B.=I G, (39)=* A, (100), . (*..DRAULI..EFG) 
R I,=E S, (20)=U M, (28), . (*..DRAULI..EFG..M....S8) 


We now add the following relationships: 
F I.=* N, (26); M H.=N G, (8); X D.=O U, (15); X M.=H T, (41); 
A X,=Y 0, (14); V F.=J A, (62); S G=V I, (105); X B.=W I, (93); 
I Q.=M B, (29); F W.=* Cy (69) 


These yield the following recoveries in the plain component: 


*HYDRAULICBEFGJI.MNO.QSTVW. 
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(5) A different method for deriving the cipher component from the foregoing matched plain and 
cipher will now be demonstrated. First, we make an abridged digraphic distribution of the plain text, 
as shown in Fig. 81, below, in which repeated letters in the columns (representing repeated plaintext 


digraphs with the reference letter at the top) have been circled. 


ABCDEFGHIJKLMNOP 


G@v aa@r "@=Ge 


2EC8 
C2 < OQ > QAQOO 4 QAAn 
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Referring to the matched plain and cipher, we make a table of the cipher equivalents of the repeated 
plaintext digraphs; this is shown in Fig. 82a, below: 


ODANOAA ANE 


AR 
AT 
BE 
D* 
ED 
EN 
ER 


.E* 


GE 
G* 
IN 
NE 
NG 
NU 
ON 
OU 
QO* 
QA 





IV 


BB 
FI 
DF 
EQ 
FN 
CK 
UR 
IR 
TS 
RB 
GX 
WK 
XR 


QH’ 


Www 
EJ 
JQ 
BR 


VV 
QJ 


TX 
KA FT BZ 


BT FB 


FF 
VI 


Figure 82a 
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QI 
RE 


-RQ 


R * 
TE 
TW 
T* 
UA 
UN 
UR 
wo 
YO 
*A 
*H 
*0 
*T 
*Y 


HD 


JV 
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(6) The fragmentary chains for both the plain and cipher components are now consolidated in 
Fig. 826, below: 


dL. UAR ON | HH BB VV LL WW FF 
2. AT | FIV QJ OW 
3. *H BE |} QU DF ES 
4. D* | IS EQ 
5. ED | CI FN LS 
6. EN | SB. CK 
Ts ER | YI UR TX 
8. RQ NU TE* | XFT IR KA QH BZ VC 
9, GE | ZX TS 
10. G* | HT RB JI 
il. IN | LM GX 
12. NE ;} LI WK FBT XM VJ QR 
13. NG | MH XR 
14. oU | XD EJ 
15. QI} RL ZF 
16. R* | CB RK HD 
17. TW] PV ZU 
18. UN | ED AM 
19. UR | DC JH 
20. wo | UVJ 
21. YO | AX CE 
22. *O | KL IW VF 
23. *T | TQ XP SZ 
24. *Y | OA LC 
Ficure 82b 


Chaining of the cipher component by the graphical method of indirect symmetry is begun, using line 
12 as the horizontal and line 2 as the vertical, followed by the addition of line 8, and in short order the 
following sequence is reconstructed: 


MFBTZPGLIQRHYOUVJCNEWKDASX 


(7) With this second method, there is no guarantee that the component recovered is the original 
cipher component. Using a blank strip for the plain component, if we try to crib in the plaintext values 
from the initial word REFERQING, we run into a conflict: 

2 4 3 1 
P: E EF R 
Cc: MFBTZPGLIQRHYOUVJCNEWKDASX 


When we decimate this sequence at the correct decimation, however, we obtain the following values in 
the plain component, 


P: R I EFG N Q * 
C: QUESTIONABLYCDFGHJKMPRVWXZ 


and the original plain component can be quickly reconstructed. 
b. For a second case, let us assume that we have at hand the following short cryptogram, and that 
we know from past experience that the enemy has used a Wheatstone system, among others: 


MLYBA FMQRQ WDWUH QPGMK TNZGA CNXJX 
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On the assumption of direct standard alphabets, we complete the plain component sequence as is shown 


in Fig. 83a, below, for the first 15 letters: 


R 
MKX* YCJNOM 


MLYBAFM 


MLYBAFMQRQWDWUH 
NMZCBGNRSRXEXVI 
ONADCHOSTSYFYWJ 


NLYAZDKOPNT* SPB 


DAMREUMHHO MHS SOMOmneHDEese 
SPMNHD PF EX AN AMOOADRUDHY 
ARO PE MAN CMOOMRUMHHUNMAS 
AMOOAARUODHH MH SSOMGKMNHD 
PPE SKS HAN* CMOANERUTDHHANI SS 
OH OMNHD PEM HANe AMOAMAULE 
OMNHODF EX HN CMOOANMROBDHS 
LROMNHD EP EMAHN* AMOAWKHUMTMH 
ASSZORVMNHDP EM HAN AMOAA 
HROMHIMHSZOMOMNAD PE Mm 
¥CMOARRUMHHANM HY SAOMAontnyn 
NMOAARUNMHHY NH SSOMOmMNHDYS 
N* QMQNOANMLOUDMHYNM HBS ZOUVnn 
SZOUGCMNHDPEXMHANe AMOADE 
OROMNHOD EP EHMHANe AMONDROT 
SoHE SOROMNHHOIP EH mANDAMOA LA 
SMSPANAMOOAMRUODAHHMHESESOMLOau 
NQMOAMhRUOAHDNMHSAZOMLOnnen 
OMA MHBSSOROMNNHDPENMHN 
NQMOOAMROTHHUNMHSSOMOMnNH 
HOPE MAHAN AMOORMKRUOEHH NM YES 
PPE eKeHHNAMOADKRODMHHM YS ZO 
HOF E XM ASIN A MOOADRUTHH MH S2 
BROMNHAR PE xX HNAMOANRLOTHS 
HOM HU EZOMOMNHDEP EX HNATMO 
AMR UDNHHUMHESESZOMOMNHDS EM 
BROTH MHSSOMOMNHDP EMH 
MOARHRUDHHO MH ESZSOKRCMNHDS 
OKNOMNHDP EX HN AMOANEOUTH 
ROMNHOP EX HANAMOANMEUGHS 


sm N *€ 
MHS 
Zone 
> & Pp pH 
onWam 
HOM H 
Hea 
<= 
oOomH 
* <Q 
> Eo 
HN 
PPE 
mH 
NM 


IGTWUZFJK 


ZYDKOPOUBUSF 
AZELPQPVCVTG 


K JW 
L KX 


FigureE 83d 


Figure 83a 


Nothing seems to be in evidence. But we are a little uneasy about our method, so on second thought 


we first decipher the cipher letters according to the Wheatstone rule of motion, at the setting A, 


=A,, 


and we then complete the 27-character plain-component sequence. This is shown in Fig. 830, wherein 


the plain text appears on one generatrix. (In referring back to Fig. 83a, we see that we could have spotted 
the plain text on staggered generatrices, had we not been so hasty.) The generatrix method, then, is the 


one to use when the components are either known or are assumed—but we should take into considera- 
tion the mechanics of the particular cryptography involved if we are to achieve a facile solution. 


c. For the next case, let us assume that we have the following cryptogram at hand, known to be 


in a Wheatstone system with mixed alphabets: 


qDRPrynw”a 
MN hm HG 
SBmMOnHDOS 
S mmo hwy 
HRW DOM 
a MUODTD « 
HhRALnNS 
ay Rook 
aoawvrzum 
COnm ven 
NSxHwsm 
VomNnhnN 
mOeHHMN A 
PHRWINtE 
LaPrFhRE = 
Lae a tos S 
<s > DOM 
Oh SHON 
RAW MmM we 
OONAEO 
OOMWHAam 
D2OMOH WM Al 
MATION D 4 
HmRWaHeD 4 
CHea> dh mw 
a ee 0 oe“ 
Mee Owe Za 
HOW MmHA 
HmanaAmMaH 
ooonrOO 
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(1) In Wheatstone systems, different encipherments of the same underlying plain text will be 
isomorphic; we therefore search for isomorphs and find the following sets 


CPs Oe 


H 
T 
U 
E 
B 


vO) Hua 
ZO QW” 
>= 
m_U 
H > 
zo 
wy 
we 


The chains derived from the foregoing are the following: 


a-b: KFR UD GCL HT 

a-c: KS HUFGO CM 

b-c: DFS LM RG CO TU 

d-e: QPK OMAIW FR VZ XJN_ EBU 


Employing the graphical method of indirect symmetry beginning with the a—b and d-e chains as the 
horizontal elements and the a-c chains as the vertical, we arrive at the following reconstruction fragments: 


HT 
EBUD 
QPKFR VZ XJN 
SGCL 
OMAIW 


There are no tie-ins between these fragments, so we shall have to see whether we can extend the iso- 
morphic passages. We therefore copy the isomorphs together with their five preceding and following 
letters, as shown below: 


a teilplKUCCFGKHHUFqjripy 
birilkqFDLLRCFTTDRpnonviiu 
«© jjyiwaSFMMGOSUUFGigzceclmi 
dthefmjQQ0OO0OIFVXBEQOMPAJFEthikzu 
esqotziIPMMWRZJUBPMAKINRBotipdg 


The solid brackets show the outer limits of the isomorphism. No new values are picked up, but the 
vertical digraph LQ between lines a—b now permits us to establish a long chain, 


OMATIWSGCLQPKFRVZEBUD....HT, 


with only two placements possible for the fragment XJN and the missing letter Y, either XJNY or YXJN. 
We shall start with the XJNY possibility. 

(2) If this is a decimation of a systematically mixed sequence, the original cipher component 
might be recovered by trial decimations to uncover the method by which it was constructed; otherwise 
we would be forced to assume decimations of —1, +3, —3, +5... —11, in turn, “deciphering” the 
cipher text in the Wheatstone fashion, until the 6 I.C. of the converted text showed us that we had arrived 
at the correct decimation. For example, using the sequence given above as the cipher component, and 
the normal sequence followed by a 27th character for the plain component (at the setting A,=O0.), the 
following is the conversion of the first 60 letters of the text and their frequencies: 


GETEI PLKUC CFGKH HUFQJ RPYLY IJMKA 
GQZPB IFIPD CHAFS RKD*L CZLWK QHNXN 
OROTH EFMQO OIFVX BEQOM PAJFE THKZU. 
KXJHF XSGOE DGPRX TRJ*A JATIN WUGKN 
ABCDEFGHIJKLMNOPQRSTUVWXYZ* 
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27(126) 
60-59 
the next six decimations of the cipher component, through +7, also give negative results. The —7 

’ decimation of our recovered sequence is the following: 





The I.C. of this converted text is =0.96, somewhat less than miserable; the conversions using 


ODFSHBPINZLMXRGTUKWYEQAJVC 


When we use this for the cipher component we arrive at the following conversion of the text and its 
accompanying distribution: 





GETEI PLKUC CFGKH HUFQJ RPYLY IJMKA 
OUOTF DHOMV UXILY XIUMO DWIZH VKYDI 
OROTH EFMQO OITFVX BEQOM PAJFE THKZU 
MZL*0O DLUDI HOIDR JYZD0 IYZDV PDQHO 
ee fa See 
ABCDEFGHIJKLMNOPQRSTUVWXYZ* 
This gives us an I.C. of 27 (238) _1 92, so we know we have hit the answer. 


(3) The entire text can now be converted to monoalphabetic terms and solved. The decipherment 
of the first 60 letters is shown below, together with the plaintext values of the monoalphabetically 
converted text: 


C: G 
pti. 0 
P: E 
Cc: 0 
M 
Cc 


0 DW 
xO R 


*x*U'U 
=O NK KP VS 'U 


"ptt, 
P: 


KOO QEa 
rHOoOOsa 
xO HON 
KUO QEBZO 
moO WOG 
xOYM ANT 
eOMm ena 
QOR nAKE 
A IN 


xO PI 
O*e HOY wae 


1c] 


AND 2c 
SU HPO Mo¥g 
<*9 BH 
HOM 6H 
Z2axz WOR 
Hr WDrmO Zzaa 
a4Q HOW Orns 
AO PHY? PHO 
HOG PH YP 


CH 
ZQ omm nw 


=z 
om GUW O-et 


VT7AKA PHG 
eM OF AIK 


SU ANS PHK 
Noa 
¥< DUH O<H 


OQ wFANO 2acy 
~ Oo 


MK 

Q 

uw 

Aa 

n 

H= 

aa PH 


"Pp": ABC 


The original plain and cipher components are the following: 


P:s HYDRAULICBEFGJKMNO 


PQ VWXZ 
Cc: AJVCODFSHBPINZLMXRGT WYEQ 
The original cipher component, a numerical-key columnar transposition-mixed sequence based upon 
HYDRAULIC, could have been recovered earlier, but this was glossed over for the sake of the exposition 


which has just been presented. 


AH 


iS) 
U 
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d. We have seen in subpar. c, above, that when we know or correctly assume the cipher component, 
the cipher text can be converted to monoalphabetic terms and solved. When only the plain component 
is known in a Wheatstone system this is still a useful bit of information, since the placing of cribs is 
greatly facilitated. For example, if the plain component is the normal A-Z sequence followed by the 27th 
character for the word separator, the encipherment of the word *ENEMY* will always produce an A-B—BA— 
idiomorphic pattern, regardless of the composition of the cipher component. We can therefore make up idio- 
morphic lists of frequent words and word combinations to assist us in cribbing, such as the following 
patterns which are based upon a direct-standard plain component. 


*ENEMY* *CROSQROADS* *COUNTERATQACK* 
A~B-BA- —A~B-BAC—C -~ABAB—---BC——C 
*DIVISION* *ROADJUNCTION* *COMQUNICATION* 
—A——-——BBA alain —=BBA Sih n aca ABS 
*ARTILQERY* *HEADQUARTERS* *RECONQAISQANCE* 
—-ABC—B-CA- —-A-A-B——B—B- —~—ABBCA——C_—- 
*BATQALION* *INTELQIGENCE* *REINFORCEMENTS* 
~AA~B-——-BB- ~A--B-C-DAC-DB —AB--C--BC——ADDB 


(1) Let us now suppose that we have available the cryptogram given below, known to have been 
enciphered in a Wheatstone system involving a normal plain component and a mixed cipher component: 


5 10 15 20 25 30 

MOLVL ELXHG MMSUK CFDUE QYIIH PSBEE 
35 40 45 50 55 60 

XNJTL CBSXF GIPHF ZKBPG WEJDP OEFOI 
65 70 75 80 85 90 

OJPMV OOKGD TIHQH AETLU DQMFW VVMCQ 
95 100 

OWGIV RULRP 


We search through our idiomorph list and find that the word *ROADJUNCTION* will fit at position 
75: 

85 90 
QMFWVVMCQ. 
NCTION* 
We set a blank strip against one bearing the normal sequence plus an asterisk, and we enter the cipher 
values from our crib on the blank strip, moving it to the left one position whenever we have to go to 
the left on the plain component. This yields the following partial sequence for the cipher component: 


H..I..ULM....U.W.EQA.V..ODF. 


Since the three letters to the left of the crib are on our cipher component, they can now be deciphered, 
and the word NEAR is confirmed by the word separator (D.) which is correctly deciphered with our 


70 75 80 85 90 
-OOKGDTIHQHAEILUDQMFWVVMCQ. 
EAR*ROADJUNCTION* 


partial component: this adds a T in our sequence immediately to the left of the U. 
(2) We now scan the cipher text, taking note of those letters which have already been placed in 
our cipher component, as shown by the capital letters in the diagram below: 


5 10 15 20 25 80 
MoLVLELxHgMMSUKcCFDUEQyIIHpsbEE. 
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' Since there are two substantial clusters (of five letters each) at positions 3 and 17, we align our com- 
ponents arbitrarily at A,=H,, decipher the cipher according to the Wheatstone rule of motion and 
‘complete the plain-component sequence. This is shown in Figs. 84¢@ and 8, below: 


| 


HAAOQWP eENw MSSM CHHWOVIOZSORUH TOI 
HNADAO VOSA RMP AGHEMQAMAOAWP tN we BS c|< 
AUVUAWDPrP EN HSS CHNWOVOZROPRAGHIO Are 
SCS] RURGHTQBAAOCQWP eNKKN SS CHHNWO VIA 
DAWPF KENNA HM SKS CHANWOHVOSZRORAUH TOMEI 
SBM CHHNDAOVO ZS OMAGH DBOQDAIAWeP ANe 

SCGHNDAOVAOA RSM ARGHILOYAGCADWYe kINKn Ss 

GHIOQNMOADP EINK MAS CHHNAOVSI ZEEE RIC 
SZERORGBHINQMAOCAWP ENK HM SES CHNAWO VOSS 
SZEBPrRGCHTRQYAMOQWP EINK KH BS CHHNWOV 


Figure 84a Figure 846 


The plaintext fragments REQ*P and CAPTU suggest THREQ*P and *CAPTURED*, and the be- 
ginning of the text is quickly deciphered: 


5 10 15 20 25 
MOLVLELXHGMMSUKCFDUEQYII4H 
THREQ#* RISONERS* CAPTURED * 

This adds new values to our cipher component, making 20 recoveries in all: 
H.-I..LMX.GTUKWYEQA.VCOODFS 


The rest of the cipher text is now deciphered in similar fashion, and the entire cipher component is found 
to be 
HBPINZLMXRGTUKWYEQAJVCOODFS 
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52. The Kryha cipher machine.—a. This machine, invented by Alexander von Kryha in Germany in 
1924, is a spring-operated polyalphabetic cipher machine which has as its principle the irregular dis- 
placement of two concentric disks which comprise the plain and cipher components. (Actually, the 
cipher component is a 52-element disk while the plain component is in the shape of a semicircular frame 
juxtaposed against the revolving cipher component.) The letters of the two components are printed on 
small metal tabs which are inserted in slots on the two disks so that the sequence of the letters may be 
varied according to prearranged keys. The displacement of the alphabets occurring after each encipher- 
ment is accomplished through a selector wheel having on its periphery 17 toothed sectors consisting 
of from one to six teeth each, the sectors being designated by the numbers 1-17. These teeth serve to 
displace the components a distance equivalent to the number of teeth in the sector; however, owing to 
the manner of spacing between the toothed portions of the wheel, an additional displacement of four 
positions is added at each operation of the machine. The selector wheel has the following effective 
displacements between its 17 numbered positions: 


No.: 4 5 6 7 &8 $ 10 IW 12 18 14 15 16 17 1 


Displacement: ‘TETEETEBEIOSSS7659 


Since the sum of these displacements is 111 (=7, mod 26) it follows that after a complete revolution 
of the selector wheel the cipher component will be displaced 7 positions to the left from its original 
juxtaposition; and since this number 7, is prime to 26, there will be 26 series of 17 displacements each, 
making the period of the machine 17X26=442. 

b. As an illustration of encipherment, let us assume that the components of the machine have 
been arranged as follows: 


P: ABCDEF 
C: HYDRAU 


If the initial juxtaposition of the components is that shown above (i.e., in the key of H), the first plaintext 
letter is enciphered in the H alphabet, and a stepping button is pressed to bring the next alphabet into 
position. If the setting of the selector wheel was at position 1 at the beginning of the encipherment, the 
next alphabet to be brought into play will be 7 to the right of the first or H alphabet (i-e., the 8th or I 
alphabet), and the one after that will be 6 places to the right of the I alphabet (i.e., the 14th or J alpha- 
bet), and so on. At the end of 17 encipherments the alphabets shall have been displaced 7 positions, 
mod 26, relative to the initial setting, so that the key series 1, 8, 14 . . . becomes the isomorphic equiva- 
lent 8, 15,21 . . .; in other words, the elements in each succeeding row of 17 letters are 7 more than the 
corresponding elements in the preceding row. The first five rows of 17 elements of the key are shown in 
the diagram below: 


1 2 3 4 5 6 7 8 9 10 ll 122 8 4 165 6 WW 


76 7:5 6 7 6 8 610 5 6 5 7 6 5 9 
1 814 21 26 61319 1 717 22 2 7 14 20 25 
81521 2 713 20 26 81424 3 91421 1 6 
15 22 2 91420 1 715 21 51016 21 2 813 
2235 916 21 1 814 22 21217 23 2 915 20 
31016 23 2 81521 3 91924 4 91622 1. 
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_ Translating the foregoing numbers into literal form as 1=A, 2=B,. . . 26=Z for typographic conven- 
ience, we obtain the complete key diagram as shown in Fig. 85, below: 


12 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 
7675 6768610565 7 


lon 
oO 
len 
ko 





Q 
rD) 


PIF SAK DARUVSVHWCSOQNNYDAwNMOURNASODY 
Lea WK DROS VH WC BZONNEYPMHOUATOT 
ZIQNACrFMAKOUAKOTPHA RAC DWRAOVSVHwWczZz 
CIZQNNOMKHOUVCNASMOLTPH SE YH WNROU Ss uHwC 
NOOR KONCNQKOTPH EAN WHRVUSVHWAZAN 
SARVUAVHWOSZQNNOAHMHOUQMODrPH EY 
ATCANOCSUVHWCSZQNNATMHOUNQNSMODMPHE 
CTH KONUNQSOTPH ERMC WROUSVHTWOCAAQNN 
HSAKDRVSVHWOZQNYNTAMHOURQCOLYS 
NOOO KOUQASTOTPH EACH DWRVUSVH Was 
GASTOCOLPHARANCAROSUVHWOCAANHNE DS 
ODPH RE ANDRUS VHWCAQNNOIAHMOUaA 
S2AQNNEFAxKHOUKQTKTOTPH ER ACSDAOS UH 
NYT KXOUNQKOTP HARE AWNWDWROSVUHWaAAQA 
QNNAEFAxXOGASKOCLPHARMWNHDWRAUSVHWCzsz 
SASAROCSUVUHWCZANYITMMwWMOUATODPY 
IARVCSAVHWOCSZQNNOMxXOUQTSONMPHEUVK 


Figure 85 


c. Kryha subsequently improved his machine by incorporating a selector wheel with 52 adjustable 
screws or “stops,” each screw having the function of bringing into play a particular displacement, of 
at least 3, of the alphabets. Any combination of these 52 screws could be used to generate a series of 
successive displacements which summed to 179 (=23, mod 26). Since 23 is prime, the period of the 
improved Kryha machine is 26 times the number of stops used, and therefore ranges between 26 (for 
1 stop, which would raise the devil with the machine mechanically) and 1352 (when all 52 stops are 
used). Below is given the stepping pattern of the improved model of the Kryha machine: 


Screw No.: 1 2 3 4 5 6 7 8 9 10 11 12 18 44 15 16 17 18 19 2 
Skips: 4343334344333 3443343 


Screw No.: 21 22 23 24 25 26 27 28 29 30 31 32 33 Bf 95 36 37 38 39 40 
Skips: $4334334443343334343 


Screw No.: 41 42 43 44 45 46 47 48 49 50 51 52 1 


Skips: 345333343345 


d. In the analysis of the Kryha machine we shall first treat the aspects of solution of the original 
1924 model and then those applying to the improved model. 
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53. Analysis of the original Kryha cipher machine.—c. For a demonstration of the general method of 
solution of the original Kryha machine, we shall use as an example a test message submitted to the U.S. 


Army Signal Corps in 1933; this is shown in Fig. 86, below: ? 


Boaws 
aa DAaAD 
VGONMD mM 
zt OM WY 
HmMnne 
a2 La > 
[sa 
Wom Hw 
cacekvwaAw 
SMO OM 
NP > PD 
COM mae 
<—& OM 
xsOM> 
acorh 4 
ONh eS 
BA MA, 
AAMeaS 
a 
AN M@& & 
=a mouo"r 
aHDANS 
Hormobd 
ATDUOO 
aarPats 
OM > ee 
ONNnNOHh 
HA MSA A, 
HOH 
“aCe ex 


EIKE ECMCI RXXLA ZLAIN MJZXI 
MMTE LLFJT JUBQO LJAWM FEHEV 


KFONO ZUMPA DAPJY LPFN 


KK OBAAE UQOYJ IZSZU HGWGW ATEJW 
xX P 

QoL 

s 


Vv 
K 
A 


IXxGOS GCOCMRF HJVXS VZNMU GJJS5 


mo me 


EZQS HLULY CYGXO NLAWQ TEJNB SMVTE 


QNLH RTMEL YNHKU FXJDM JYCP 
GUWO ITAITIG PTSFC SOKID GGTYO 
RRMN TSHYN EXYVF CMJJK NXVTE 


B 
M 
Q 
Ss 


C 
R 
Q 
P 


Q 
xX 
D 


UY NJIKXF PEPGF CMMCW ZRPJY GOPZU 
XI AXZKQ MJEFW WMRQR TETPX RSUK 


LHED LLCTJ KSZMQ MKNJU VPFLY HYF 


Xx 
Vv 


H 
Q 
D 


DI 
Qc 


ZMBMPB OJXEQ IZAXH NDBQQ W 
YK E 


Y JGQJO0O FWFCD BXYNX YTW 


WND 
IFA 


G] A. 


OmMmHnN> 
OuUH> Hm 
Om > > PS 
HOSP Pa 
omtmMu a 


TlMNkmNH 
OmMmNH 
aan oo 
& Tso & 
> moun 


HANHO 
HRN Ee 
aoa Ee 
RHI 
Oatu Nn MK 


QaPead 
AAN Mm 
AUBOD 
HMHONMA 
PHBOd 


N OG BI > b¢ 
OoAeNnkA 
BRAOEFA 
SIN Om iM 
ncmMmoatm 


NDOWH24 
omg Hd 
Arta maA 
~WMHO 
ABmMHE MN 


GV IKROO SOVMG HKUNU SUNYV 


FELO OWSATI YRREV NEXPE SEGRP ZNBMM 


ET PSUHC SOYTP VYIKZ NFVIE 
YUZFG SXRXW MNWTL RHVFH GSXMW VREAJ 


T 
Y 
C 


DGOZA GRX¥KJ LDOGY PTYXN TMWQM YSQWL 


XHNGZ QDMCW PYATG NZFJK WGDKA VSJMH 


GG LGKKR 
GW WXHFA 


Q BMCDY JFMBL SXKEOT LFJ 


GWJIE CWTDB ZNMYT NAORV HARRP DXGCA 
A LHHJV CGYVR LYSPJ VPK 


HJINZ KTLQR QUJAF FZGDX LRFFS AWSZN 


LSA 
Y WD 


J 
P 
G 
Y 


RG UJEJW TAFSN ZX¥VVW IYWOO MTLUF 
AJ RNRMP IYLWI KAOKH TMXCN IMWTF 


TTDE HTDHM KKCDK EAPHI AXZYP 


CMT 
SBC 
G 


Figure 86 


2 The interesting circumstances surrounding this case are recorded in an article by the author entitled “Q.E.D.—2 


Hours, 41 Minutes,’”’ published in the NSA Technical Journal, Vol. XVIII, No. 4, Fall 1973. 
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b. Now it is clear from the key diagram in Fig. 85 that if a message were encrypted starting at, say, 
position 1 of the selector wheel and “alphabet 1” of the enciphering components, the Ist, 9th, 33d, 
41st, and 57th letters, for example, would be enciphered in the key of A, and would therefore belong to 
one monoalphabetic distribution; this is shown in the key fragment in Fig. 87a, below. It may also be 
seen that, owing to the isomorphism of the key, even if a different initial alphabet were used (take 


1 2 3 4 5 6 7 8 9 10 11 12 13:14:15 16 «17 12 3 4 5 6 7 8 9 10 #41112 13 44 «15 16 17 
76756768 610 7659 76756768 6105657659 
@MHNUZFMS@GQVBGNTY @MIOVAGNT@HRWCHOUZ 
HOUBGMTZHNXCINU@F IPVCHNUAIOYDJOV@G 
OVBINT@GOUEJPUBHM PWCJOU@HPVFKQVCIN 
VCIPU@MHNVBLQWBIOT WDJQV@IOWCMRXCJPU 
Fiagurek 87a FIGureE 87b 


any other letter in the first column of Fig. 85—for example, B), as long as the selector wheel was set 
at position 1 the ist, 9th, 33d, 41st, and 57th letters would still be monoalphabetically distributed, as 
shown by the key fragment in Fig. 876, above. Therefore in the course of analysis a total of 17 sets of 
distributions might have to be made, and the correct initial position of the selector wheel would be that 
in which ail 26 distributions of one of the 17 sets revealed a close approximation to the expected 6 I.C. 
for the language involved. 

c. One way of making the distributions is to write out the cipher text in a block consisting of rows 
of 17 letters, allocating the letters of column 1 into 26 distributions, each succeeding letter in the column 
being recorded in a distribution 7 away from its predecessor because of the +7 isomorphic progression 
of the key; thus the letters of column 1 would go into distributions 1, 8, 15, 22,3.... Then the letters of 
column 2 would likewise be allocated into the same distributions, but starting with the proper distribution 
for the first letter of column 2 (which depends upon the selector position assumed for the first letter of 
column 1). For example, with selector position 1 the keying sequence is that shown in line (1) of Fig. 88 
below, so the first letter of column 2 would be put into the 8th distribution, the first letter of column 3 


2 5 7 9 14 1 16 17 


1 3 4 6 8 ® U 2 1B 

76 7 5 6 7 6 8 610 5 6 5 7 6 5 9 

(1) 1 81421 26 61319 1 71722 2 714 20 25 
815 21 2 7. 


(2) 1 71419 25 612 20 261015 21 26 71318 
1 8142126 6. 
x * ke ek ke Kk OK 
(17). 1 
1017 23 4 915 22 21016 26 5111623 3 8 


17 24 411. 
Figure 88 


into the 14th distribution, and so on to the first letter of column 17 which would be placed into the 
25th distribution. In testing for initial selector position 2, the keying sequence is that shown in line (2) 
of Fig. 88, so if the first letter of column 2 would be put into the 7th distribution, the first letter of 
column 3 into the 14th distribution, and so on to the first letter of the last column which would be placed 
into the 1st distribution. Finally, in testing for initial selector position 17 with the keying sequence 
shown in line (17) of Fig. 88, the first letter of column 1 would be put into distribution 1, while the first 
letter of the last column would go into distribution 3. 

d. A much easier and quicker way of making the distributions presents itself, using a grille to be 
placed over the cipher text which is written out in a block 17 wide. Using the key diagram of Fig. 85 
as a guide, we cut holes into our grille at the locations of any arbitrary key letter, say the letter A, as 
shown in Fig. 89, below. We then complete the grille as illustrated in Fig. 90, with the necessary cyclically 
offset portion shown in dotted lines, and the grille doubled in length for convenience in use. (The heavy 
circles show the index or reference position used in designating the placement of the grille over the 
cipher text.) 
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ee 


@MHNUZFMS@GQVBGNTY 
HOUBGMTZHNXCINU@F 
OVBINT@GOVUEJPUBHM 
VCIPU@MHNVBLQWBIOT 
CU PWBHOUCISXDIPV® 
JQWDIOVBJPZEKPWCH 
QXDKPVCIQWGLRWDJO 
XEKRWCJUPXDNSYDKQY 
ELRYDJQWEKUZFKRXC 
LSYFKQXDLRBGWRYEJ 
SZFMRXEKSYINTYFLQ 
ZGMTYELRZFPU@FMSX 
GNT@FLSYGMWBHUTZE 
NU@HMSZFNTDIOT@GL 
UBHOTZGMU@KPV@HNS 
BIOV@GNTBHRWCHOUZ 
IPVCHNU@IOYDJOVBG 
PWCJOUBHPVFKQVCIN 
WDJQVBIOWCMRXCIJIPU 
DKQXCIPVDJTYEJQWB 
KRXEJPHWCKQ@FLQXDI 
RYELQWDJRXHMSXEKP 
YFLSXDKQYEOTZELRYW 
FMSZEKRXFLV@GLSYD 
MTZGLRYEMSCHNSZFK 
T@AGNSYFLTZJIOUZGMHMR 
AHNUZ 
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e. We now place the grille so that the index position is over the first letter of the cipher text, as 
illustrated in Fig. 91¢ (only the top 40 of the 67 lines of cipher are shown here), and we make the following 
distribution of the letters exposed through the apertures: 


~ 
= 
Bu ake. aie “CS ae Se 


~sen~Bes =au-nz 
ABCDEFGHIJKLMNOPQRSTUVWXY 


N Jil 


This distribution has a 6 I.C. of 1.18, nothing to write home about. We then slide the grille over one 
position to the right, so that the index position is over the second letter of the cipher text, and we arrive 
at a distribution with an L.C. of 0.95. Sliding the grille so that the index position is over the third letter 
of the cipher, we obtain a distribution with an I.C. of 0.97. When, however, we slide the grille so that the 
index position is over the fourth letter of the cipher (as illustrated in fragmentary form in Fig. 915) 
we obtain the following distribution: 


Ss = = Se = Zz 5 
HIJKLMNOPQRSTUVWXYZ 


Mil 
“it 


= # FLs 
ABCDEFG 


The I.C. of this distribution is 1.79 so we know that, barring the touch of a Mephistophelian (or rather, a 
Bernoullian) finger, the fourth letter of the text was enciphered at position 1 of the selector wheel; 
therefore the initial setting for the first letter must have been position 15. In any case, we shall prove or 
disprove this point very quickly. 
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f. If this is the correct initial setting of the selector wheel and we drop the grille vertically one 
position, the letters exposed through the apertures will still be monoalphabetically distributed, but in 
an alphabet +7 away from that which we have just obtained above; in other words, referring to Fig. 85, 
if the letters exposed in Fig. 916 belonged to the A or Ist alphabet, then sliding the grille down one 
position would reveal the letters that belonged to the H or 8th alphabet. Sure enough, the I.C. of the 
distribution of these letters is 1.92, so we know that we.are on the right track. By successively sliding 


5 6 7 8 9 1011 12 13 14 15 16 17 123 45 8 9 10 11 1213 14 15 16 17 
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CFHOOMUONZONOBTO TOMA VKEHACTUOMOAZHTARP EWU AR BH 
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AOQwWwaKOHOrFrAcCAHik< mM TANS TAMA VHANBOVCAMHEDWOMTONTDWDY!A 
EOWONHUW KOK OQ KX EMO AMKNOUWMxX HK A@XOHHmMaA<o <u 


Q@zamuanroeoweranmwezwmonrtroemarv4nGomseorzenvcernyle 
OCHNUUSK OH OX TMHMH ET eM ZHHUDONOWMZNGCOBRUOH AAU 


SCOtrw°eoOeEK ME CVA MASZSRERWOANEBEUOKCHAm awe vs co wmzOR AIH 
CAM NMVIABVVO WON EK sent aACUuUTACRAUkKO BPM AVA 
YUERAOxXUDNQVANAMPOz~D<dQHHOG MOUND OP GCHE> Pr eR EU® 


Ar>woeKcOHorrMmAoslsmrnaex reek VvHMBAAAMHEDONOS 
ISX QNQAAHAKEF MEH VZAAMBAOVVHAGCMQOAOQEENSTNZAMQHNLOATATA 


OHODANZUXR FO CEUUONQDHAePENCrFAQEAOArxHLVH ATC 


HO DOCKHNEZERUORHoORDNOMUNADVA MP UNNE CDW 
@rcexvnvwnrezr<lannvrcraouwrrrOn keer sexEurnen zo 





THRMRAAHAKE>E RM EUKvOVZSEMBAOVAICNQOeH CRE ENCSNZQNGOOEO KATH 





ARQOTAKCEPNANARWK PN ePMQADWEXBHNZEOHHCrZCANCTAD 
AQHDRAKEPNANDARA KH PHN rPAQOWDEXHHOBSEPHHGCrzZCANSC TA 
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NEOKDRZHOMR US BEHIZCHOHOFNAMBDAZUOMRKKHUK ES RANO 
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the grille down one position at a time in Fig. 916, we obtain the 26 distributions shown in Fig. 92, below, 
given together with the numerical designations of these alphabets (in parentheses) and their I.C.’s. 
The average I.C. of these distributions, 1.88, makes us very happy. 





Alph ABCDEFGHIJKLMNOPQRSTUVWXYZ IC. 
1. (21) [5 5 413 122 2 6 13 3 6 1| 1.79 
2. (2)|23216 2 2 15 5 163 5/1.92 
3. (9) 131461113 12 71311111 + «3/1.58 
4. (16) |3 4 21 14 2121231 2 481 |1.72 
5. (23) | 67241 14 A211 332 1 1.87 
6. (4)/ 1211 P07 42 2112 2644 1.78 
7. (ll) {1 2 4 21 24635 11251 3 /1.64 
8. (18) 1874131 253 1 2 311) 2.19 
9. (25)/1 33256 61 1211 5 633 |1.84 
10. (6) |21 4 4 5 2 1 146 535 1.96 
11. (13) |41 21 4 23 5 45124 22 1/ 1.50 
wz. (20) /2 1 9414 4 24 1 13 3 #13 1 «412.95 
13. (1) /11431 2 1 2612 4 1 77 3/1.96 
14. (8) j2 531 1 1 3 323 8 6 421) 1.94 
15. (15) 443 561127 11 61 4 11.73 
16. (22) |6 110 4 32131111 3211 3 1| 2.10 
i7, (@)i2 26: 2.4 A 4 251 16 6 6/ 2.01 
18. (10) |3 2 3 36 3137 5 3 3| 2.05 
19. (17) 42 4 11 33762 11k 303 Si 179 
20. (24) 135 2 3 81 1621 21 2 22 2 /1.90 
21. (5)/ 1 2 33 541 25 6 2 8 |2.36 
22. (12) [22 1 2 5 1.18 
23. (19) 5 2 1 | 1.63 
24. (26) 1 2 1.76 
25. (7) 4 2.96 
26. (14) 2 1.68 


Figure 92 





g. The next step is to rewrite the successive columns of Fig. 92 as rows of a new matrix for con- 
venience in the matching process on which we are about to embark. This new matrix is shown in Fig. 93, 
below, in which the cipher letters are at the left, and tally totals for each row at the right. The frequencies 
within each row represent the frequencies of the successive plaintext equivalents of the cipher letter 
designated at the left, and therefore the method of solution bears a close resemblance to that of the classic 
progressive alphabet cipher in which we match the cipher-letter rows to obtain a statistical reconstruc- 
tion of the cipher component, regardless of the identity of the plain component.® 


* Cf. pp. 162-168, Military Cryptanalytics, Part IT. 
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(1) A tabulation is now made of the rows in descending order of total number of tallies, as shown 
below: 


3.52.50 49 48 47 45 44 435 41 40 38 37 36 33 27 
Y F A T H Ss R I ZU B 


~~ GIN 
Happ 
VOoOBZzQlA 
a< O[/ 
Or wip 


We begin by matching the J and M rows which have the most tallies, and we arrive at the highest ¢I.C., 
1.89, for the following juxtaposition: 


J oe ne 152 
M ---546-1141 


ALU 136s Foe 2 a8 
72-22-7- [-2-1422 


The next three heavy distributions, X, Y, and F, are easily added, since the ¢ I.C.’s with the J row yield 
1.84, 1.82, and 1.83, respectively, for the best matches, as shown below together with the columnar 
sums of frequencies, labelled 2(a). (The line at the top shows the relative placement of the five letters 
in the cipher component.) 


eek wn Corns hse etd YW os Mo eo 
Jij2-1447-315241151-6--3--+1-2 
M---546-114172-22-7-[-2-1422 

X 1-(-318-4-3352-74-3--3-+-231 

Y¥ -21724-6--28--+51-(6--1-=+=313 
oF 1=-854-4-5341-435-31+-+4-[1-12 
Z(a): 4 2 2 27 16 29 — 18 2 17 il 28 6 1 23W~— 6B 1 — § — 2 10 7 10 
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(2) We now use the summation row, (a), as a means of strengthening our results in matching the 
next five rows, yielding I.C.’s of 1.71, 1.96, 1.92, 1.85, and 1.78 for the highest scores, and we obtain a 
new summation row which we label (8). This matching is shown below, with the letters in the top row 
representing, as before, the placement of the letters thus far recovered in the cipher component. 


Jess Ear alee ete Ree TE A Me Bee ae 

Z(a): 4 2 2 27 16 2 — 18 2 17 11 2@& 6 1 2B 11 — 2 1 — ¢ — 2 10 7 10 
A12-623-3-237--[52-3-~1-1242 
T-3-861--12-+-4--131E-51-1-11-~- 

C Pee 2 25 ee 14S Hl) 2 ee SS ee BIS 
E1--(463-41412-191-4-s#---- 42 
Hees 427 22590 - 16 e156 ose eG eS 1 eA 
2(8): 8 7 2 56 34 39 — 31 5 25 17 53 6 3 6 20 — 44 2 — 20 — 4 14 19 23 


Using the 2(8) as a base, we are able to match correctly the remaining rows, with £I.C.’s ranging between 
1.64 and 2.13, being helped of course by the fact that no two rows may match flush. The final matching 
of all the rows is shown in Fig. 94, below: 





JQXEPSWGIUBNLZAKTYHMRDFOVC. 
J72-1447-315241151-6--3--1- 2] 
M---546-114172-22-7--2-1422 
X 1-E318-4-3352-74-3--3-~--231 
Y-21724-6--28--51-[(6--1--313 
F1--854-4-5341-43-31---f—f_-12 
A12-623-3-237--[2-3--1-1242 
fT -3-861--12-4--131E51-1-11-+-- 
Cc 2--722-3--14--102-4--3---26 
E1--463-41412-191-4------ 42 
H ---421-31-18-153-3—E-6--124 
G --2631-B-41---76-41-3---3- 
N 1-3615-2242R-122-4--1--132 
011-62--412-+-71-72-4--3--E12 
P --16[65-212351-5--3--2---11 
D1l--342-3-4-32222-4--3E£1142 
Vv 1-1652-5-1161-63-2----- 2E 1 
W2--334-614-41-63-3--~--- £2 
S 1--32(% -3-321-164-4--2--1-5 
K ---634-313151-4R-1----1-23 
L11-336-2-226[,--32-4----- 221 
Q -F -7311532111-21-5--2-12-2 
R --1423-31315-122-2-12-1131 
Ir11-45615@2111111-~-+----- 2-3 
Z1-1633--1232-—253----1--1-3 
U -1-651-3-8$-12-22-5------ ed 
B ---512-122—E3--61---ll-l1l--1l 

SRARtraeegae* SEBS RBSRABREBSSSE"™ FT SSOPFRSVS 


FIGURE 94 


(The numbers at the bottom of the columns represent the frequencies of the letters, as yet unidentified, 
of the underlying plain text.) The cipher component as recovered is 


JQXEPSWGIUBNLZAKTYHMRDFOVG, 


but knowing that there is a decimation of 7 involved, the original cipher component must have been 


JNFGHEACBDWYXZVURSTQLOIMPK. 
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h. Since we know both the cipher component and its motion, we are now able to reduce the cipher 
text to monoalphabetic terms, using an arbitrary A-Z sequence for the plain component at the initial 
setting as shown below: 
KLMNOPQRSTUVWXYZ 
WYXZVURSTQLOIMPK 
The first cipher letter of the message, X,, is deciphered as M,; the second letter, Y,., involves a shift of 
the cipher component of 6 positions to the left and is therefore deciphered as F,; and so on for the reduction 
of the rest of the text. The reduction of the first 10 of the 67 lines of 17 letters is shown in Fig. 95, 
together with the distribution of the monoalphabetically converted text. 


15 1617 t 2 3 4 5 6 7 8 9 10H 12 134M 
































6S9TETSEETESEIOSES5 7 
C: XYICPNDEAMAPODTRAX 
MPI: MFLNXUVMHRUEJIBLM . 
C: XPZXHYRYTWQXFHCODJ 
"P":; FLVLWKXVLMXALVNLHT 
Cc: KAHQURZPPPZQOFUVK 
"PX; LMFLAVLRLENLHEMFL 
C: FEMNEAONGTTXSVVUN 
"Pn; HERMJEMNJIRLXWJIEZN 
Cc: DGJREJFHEOKVCQHFEH 
"P": HVNUCRMJENLSFHNFC 
Cc: ROKUPMQPQWACOJCRL 
"P";: HGFMOHWWLVLEMHJML 
Cc: MBMEVKRVJDYNNSXKUD 
"Pp"; HMWVXCMFLNJIRLRHET 
C: LHNPFWMOCMJFLGPMB 
"Pr: XBTHEGMFLURLXWMFL 
C: KHAUXLIVVQSXKUNJZU 
"P":s VURRHJERLJBOLNHOL 
Cc: KKOBAAEUQOYJIZSZU. 
"P"; OIZDUOGLIEOVLSRHE 
z 
ze 
= z Zz = 
2Z SF BB BBZBZL z ~ Zo 
= SS. 222 22 2B ZBZZZ 2x ZFZZZ = 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
FIGureE 95 
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_ The simple substitution is now easily solved, beginning with the identification of L, of the converted 
text as E, and the initial trigraph MFL, as THE,. The decipherment of the first two rows is shown in the 


fragment below: 
% 1617 12 3 4 6 6 7 8&8 9 10 11 12 13 14 


6BS9TETSETESSEIOSEST 
Cc: XYICPNDEAMAPDTRAX 
“P’; MF LNXUVMHRUEJIBLM 
P: THECOURTISUNABLET 
Cc: XPZXHYRYTWQXFHCDJ. 
“Pv: FLVLWXVLMXALVNLHT 
P: HEREFORETOPERCEIYV 


The recovered plain component, set in position against the cipher component for decipherment of the 
first letter of the text, is as follows: 


P: PLMJNHGIB 
C: JNFGHEACB 


Since the sequences were made up at random (but not too thoroughly mixed at that) and since three 
letters did not occur in the first 170 letters of the plain text, we cannot be certain of the placement of 
the missing letters in the plain component. (An X, does occur, however, at the 539th and 647th positions 
of the text, so this letter could be inserted in its proper place in the plain component, immediately to 
the left of the S.) 

zt. In subpar. e we arrived at the correct grille placement by sliding it through successive positions 
of the cipher until a favorable I.C. was reached. The theoretical I.C. of the cipher letters at an incorrect 
setting of the grille, however, is not 1.00 as might be supposed. For example, if we place our grille (with 
the ‘‘A’”’ positions cut out) over the key diagram of Fig. 85, we shall expose 17 A’s, of course; but if we 
move the grille one position over to the right, instead of a random assortment of equiprobable key 
letters we obtain a severely limited distribution of 4 F’s, 6 G’s, 4 H’s, and one each of the letters I, J, and 
K. The distributions of key letters for the 17 positions of the grille are shown in the diagram below: 





do 7 

2 464111 

3 425312 

4. 1 61341 1 
5.16 21 232 
6 2 33332 1 

7 1 13°54 2214 

8. qo hiss 
9.4611 23 
10: 116432 

ll. S317 24 

1, 1-4 45.3.1 1 
13.333 2 1 23 
14. 12 61232 

15. 114316 1 

16. 213524 
17.464 1: hk 
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It may be seen that the number of different key letters in the wrong cases is 6, 7, or 8, with biased dis- 
tributions which are symmetrically disposed between 2 and 17, 3 and 16, 4 and 15, etc. This may result 
in situations wherein, if the number of letters in the distribution is too small a sample, a wrong grille 
position might yield an I.C. even in excess of the expected 1.73; that is why, in subpar. f, we reserved 
judgment until we made additional distributions at our assumed setting to confirm its validity. In order 
to establish the theoretical I.C. of the cipher text at a particular wrong setting of the grille, we must 
calculate the bulge of the y I.C. (ie., y—1, or the excess over the expected 1.000 for random), which is 
rer 





given by the formula 6,= , where 8, is the bulge of the cipher text, 6, the bulge of the key, 6, 


the bulge of the plain text fe English, .73), and ¢ is the number of categories (in this case, 26). Thus 
26[6°+2(47)+3(17)] _ 
17? rc 


=0.16; therefore the 


for selector position 2 with a distribution of (4, 6, 4, 1, 1, 1) the y I.C. of the key ‘is 


6.40, the buige 8,=6.40—1.00=5.40, and the bulge of the cipher 8,.= G-A0)(79) _ 40) (.73) 


25— 
expected I.C. of the cipher text is 1.00+.16=1.16. The complete table of said is shown below: 

Exp. Exp. 

Yx Bx Be IC. Yr Bx Be LC. 

1. 26.00 25.00 0.73 1.73 10. 6.038 5.03 0.15 1.15 

2. 6.40 5.40 0.16 1.16 11. 6.58 5.58 0.16 1.16 

3. 5.30 4.30 0.138 1.19 12, 4.94 3.94 0.12 1.12 

4, 5.85 4.85 0.14 1.14 13. 4.06 3.06 0.09 1.09 

5. 5.30 4.30 0.13 1.138 14. 5.30 4.30 0.13 1.138 

6. 4.06 3.06 0.09 1.09 15. 5.85 4.85 0.14 1.14 

7. 4.94 3.94 0.12 1.12 16. 5.30 4.30 0.13 1.13 

8. 6.58 5.58 0.16 1.16 17. 6.40 5.40 0.16 1.16 
9 6.03 5.03 0.15 1.15 


The average of the theoretical I.C.’s for the 16 wrong settings of the grille is 1.14. 
j. Once we have recovered the components, the solution of additional messages using the same 
components is a simple matter. For example, let us assume that we have recovered the components as 


P: HYDRAULICBEFGJKMNOPQSTVWXZ 
C: QUESTIONABLYCDFGHJKMPRVWXZ 


and that the following message is at hand: 


CNCAX VHNQO J 


oc CKOQ JIAFL QNMOV 
UAKGO BEUSG BBVFD RCCQO 


The simplest procedure here is to prepare a diagram such as that illustrated below, in which the first 
row of letters represents the “decipherments”’ of 


5 16 17 18 19 20 21 
‘0 8 15 21 2 
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6MHQAQHA|-o© 
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4 Since we are dealing with the entire key population in the various cases, it is the ~ I.C. given by 


cZf(f-1) 
N(N-1)° 


= 





volved here and not the 6 I.C. given by 
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the first letter of the cipher text, C, (using the components at the initial setting H,—Q,), at 17 con- 
secutive positions of the key (starting with selector position 1). The second row represents the 17 
decipherments (starting with selector position 2) of the second letter of the cipher, N.; and so on for 
the decipherments of the first five letters of the cipher text. One of the diagonals in the diagram must 
represent the correct keying of the selector wheel, but at an arbitrary juxtaposition of the components; 
therefore the next step is to complete the plain component sequence for, at most, the 17 diagonals. 
This is shown in Fig. 96, below. In the generatrix diagram for position 10 we see the plaintext fragment 
AMMUN, so we know that the message was enciphered starting at that position of the selector wheel. 
The rest of the message can now easily be read. 


Pos. 1 


QYAWQAHCTCPDWONHITINM SK HNO VOAZBZARGOQ 
NMB<SHNOVOZEZAOUQAMAWDAHTrCrPAUKST 
SMSC HANO VIO ZAZA OAKQNAAWAHFrCHYPAUOUHIN 
YUQQAMDQHDTOCrPDWOKHMTNMASHNOVOAAN 
KEK HNOVOZZRAUQDAAWQHECrPAUOKIN 


PDAUOUNKN TNH BEAM ANOVOSZAANRAGQHQAMAWAAHTS 
OUVAOAZAUQAMAWDBWQAHOTCHPAUOUHOINKBSSHMN 


Pos. 2 





SOAEBZRUQNBAAWAQAHOTACPAUKIOINHK SAS HNO'V 
QHrTCRPWDWUOUH INK SSH NOVOAZAARGCON AAW 


VOBZARAUCOQDWAWAHYHMCHPAUHIN KSSH NO 
SBS HANOTVOARZAGCQIAIAWAHEYCHrRAUKIN 


Figure 96 


MQAMAWAHMTCPHAUNHINHSSHNOVIOAZAAG 


Pos. 3 





QAAWAHOTOCPAUNH INK SSHANOVSOIAZARAG 
OK IN MS SHA NOVOZBERGCDQDAAWAHErCY DW 


NAAWQHOTCPHAUNMN IN HM SSHANOVIOAZARAGQ 


* 
* 
* 





CrPAUNMN TNR SSH NOVOZASEACONAAWOAHE 


Pos. 10 





ZERCQBAAWAHMTCRPAOKIOIN MK SSH NOTVS 
ZERUCQDQAMAWAHMTrCRrPAUKH INK SSHNOVO 


rOPrPrDWUoUnKXt IN SCH NOVO ZEAGCQDAWAH 
SO ZERGQBAWQAHCCPAOXKX IN MM SSH NO'V 
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k. One of the properties of the Kryha machine is that causal isomorphs may occur, but only at 
multiples of 17 for the original machine (or at multiples of the number of active screws for the improved 
model). As an example, let us study the following message known to have been enciphered with the 
original Kryha machine: 


5 10 15 7 
YRHOQMAHNWXUXIVSU, 
QXRWXTILAGSDAQMFT 
DKZLQJDKHYLAMSHXB 
YGZFIXGHEKMFRXAXXK, 
GKBOXVFBQIHYSXLDZ 
WQWKYIHSYDREXSKZJ 
UYOVHBXOWDEIFNOMY, 
HFYZDXKTPTVCLBMDG 
WPOPZIZDHCMQMVNZL 
VOUITYTMUKABCBENEC, 
XBOXKPQGSFSVKZNBD 
GMSKZERPOVWKZEEEV, 
MVDLEQKDTBPCBCAEV 
CRFL 


(1) Several isomorphs have been found and these are listed below: 


aRHOQMAHNWXUXJIVSUQXR 
bYOVHBXOWDFJFNCMJHFY 
c OUJYTMUKABCBENFCYBO 
d.HEKMFRXXXKGKBOXVFBQIH 
e POVWKZEEEVMVDLEQKDTBP 


The derived chains are the following: 


a-b: RY QHOVC SMB AXF UJNWD 

a-c: ROJE HUC QY WAMT VNK XB SF 
b-c: HYOU VJCNE XMFBT WK DA 

d-e: HP XEOL FKVQT GMW RZ _ IBD 


It is but a simple matter to amalgamate these partial chains into a complete equivalent primary com- 
ponent, 
VJICNEWKDASXKMFBTZPGLIQRHYOU, 


which when decimated at an interval of +5 yields the original component: 
QUESTIONABLYCDFGHJKMPRVWXZ 


(2) Since we are in possession of the cipher component, we can assume an arbitrary A-Z sequence 
for the plain component in order to reduce the cipher text to monoalphabetic terms. But since we do 
not know the starting position of the selector wheel, we must be prepared to take all 17 positions in 
turn, making trial reductions of the text to find the correct one as revealed by the expected 6 I.C. for 
the language. The conversion of the text starting at position 1 of the selector wheel is shown below: 


1 34 5 6 7 8 9 10 11 12 13 14 15 16 17 
K: 767567686105657659 
Cc: YRHOQMAHNWXUXJIVSU 

"P"; LODMBOWYHRIGXLJIKD 
C: QXRWXTILAGSDAQMFT. 

"P":; TKBWSSMLBCGLANZOZ 
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The L.C. of the entire converted text at this initial position of the selector wheel is 1.15. When, however, 


11 12 13 14 «15 16 «17 t 28 4 «5 6 7 8 8 1 


K: 5657659767567686 10 


Cc: YRHOQMAHNWXUXJIVSU 
"P": LQFQDQAZJITNLCONME 
Cc: QXRWXTILAGSDAQMFT 
"P": TMDAUUQMDELQFQDQA 
we reach initial selector position 11, we find that the I.C. is 1.68.5 The monoalphabetic substitution is 


now solved, 
11 12 18 14 18 16 17 12 3«4« «68 6 «7 8$ 9 10 


K: 5657659767567686 10 


C: YRHOQMAHNWXUXJVSU 

"P"™; LQFQDQAZJITNLCONME 

P: DIVISIONHEADQUART 
Cc: QXRWXTILAGSDAQMFT. 

"P": TMDAUUQMDELQFQDQA 

P: ERSOFFIRSTDIVISTIO 
d to be the HYDRAULIC . . . XZ sequence. 


and the plain component is foun 


5 For the statistically curious, the following are the I.C.’s of the trial reductions to monoalphabetic terms of the 
entire cipher text at the various selector positions: 


1. 1.15 6. 1.14 10. 1.20 14, 1.18 
2. 1.31 7. 1.15 11. 1.68 15. 1.10 
3. 1.31 8. 1.14 12. 1.22 16. 1.20 
4. 1.19 9. 1.31 13. 1.07 17. 1.35 
5. 1.16 


et Pe _ ¥2(ce-1) . : ; 
The standard deviation of the 6 I.C. is given by the formula ¢ YNQoI” which for this 225-letter message is 0.03, so 
the range of I.C.’s in the wrong cases, 1.07 to 1.35, might indicate astonishing deviations of 2.30 to 11.7¢. But this ap- 
parent paradox is easily explained, since we know from subpar. ¢ that the expected I.C. in a random case for the original 
Kryha machine is 1.14, and the formula given above for the standard deviation of the I.C. applies only to those situations 
wherein the expected I.C. for random is 1.00. 
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2. For the last example of solution of the original Kryha machine, let us assume that we have a 
cipher message and its compromised plain text. This is shown below, written on a width of 17. 


ON DZ PV Ba SK DO KWH WN NY Ws 
nex DS ZO WAT ON AM VT Ao PY AHe 
AH PZ UM ZH DS PH AA As OR As 
ow <2 CWHHA OMA VU Ar NAO HM ADM 
Tm Mo ZEN MHS CC ITH AR AP Sr Woe 
wu wor azardir AWN S22 GW HAs 
or f< Su Pw wToO LY BO Ue We NV 
Q0¢822% 2 WE Awe PO DR DAK PH MH HPs 
A= WoO WAH WO WO HNW WAV WHA OWE 
Qe By wo AQ TAQ WA At Ae MSN HCE 
O22 NM OF BH HW Wl OG UA HER OSG 
CH Q0H 2G SRB HBA PV VAG OF Qa Cee 
HO HO Am AW OD KS VP SN LM AMSG 
2H 2m HW ZO DAD FO PO AN FAN Bs 
QHvuwmtos on Pw AWAD Wo NI AHAY AAS 


AC CH DRO UM PE PQ HP TI HAZ WW 
ArT Ar Gya AW aQeE AN WO BHO ZH AR 


(1) The first thing we do is to record the cipher equivalents of identical plaintext letters in the col- 
umns, at intervals of 1 row, 2 rows, . . . 9 rows which correspond to intervals of 1, 2,.. . 9 multiples 
of 7 on the cipher component. This is shown in the diagram below: 


Interval N: 1 2 3 4 


8 9 
7N (mod 26): 1 1 


1 


-- Vv 


3 
I 
nd 
I 
on 
lo 
o1 
| 
eo 
Oo 
| 
AN 
wh 


| 
| 
| 


oF 
<cl 


RQOoAunKrsaa 
<UMxHRGAHS 
ANReM wT 
Wowzawmr” 
S4UOHDWW 
GaQco zy 
YVRaQAHZH 
ZANDOWs 
GaN Pon 
o2 18 LE 
<sAGHo 

= 17co 


In the first column we have the chain LJX, which should be spaced on the cipher component as 


5 10 15 20 25 26 
Lig i ee, te OOD Se Ke 


Adding to our sequence the XC from the second column, the JM from the fourth column, and AXF and 
JN from the sixth column, we obtain 


Lb.C.F..3J.M. ww. KX... LNA 
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Incorporating relationships from the other columns, we are able to complete the reconstruction of the 
cipher component: 


LYCDFGHJKMPRVWXZQUESTIONAB 


(2) For the reconstruction of the plain component, we make a 26X26 matrix with the recovered 
cipher component at the bottom, and we distribute properly the plain-cipher relationships of column 
1 of our matched plain and cipher, starting with R,=B, in the top row, S,=N, seven rows down in row 
8, Hp=P, in row 15, etc.; this is shown in Fig. 97, below, wherein the first four entries have been ringed. 


2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


® 


Ae 


ODANOUAA ANE 
GQ 


= Z a @ 


24 : R 








26 h drau i e Ss 
C: QUESTIONABLYCDFGHJKMPRVWXZ 


Figure 97 


The partial plain component reconstructed from the values in the first column is 


»Hs DRAU ) Ts 2. Bie eee eh ee eS 


With the addition of the information in the other columns, the plain component is reconstructed as 


follows: 
TV.ZXKHYDRAULICBEFG.KMNOP.S 
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55. Concluding remarks.—a. Some words on the diagnosis of systems employing the Wheatstone 
device or the Kryha machine might be apropos. In both cases, the expected monographic I.C. is 1.00 
since every key letter has an equal chance of occurring. As for the expected digraphic I.C., in a Wheat- 
stone system there are only 26 ways in which a plaintext digraph may be enciphered; therefore since the 
digraphic I.C. of English plain text is 4.66, the expected digraphic I.C. can be approximated by 1.00 


plus 1/26 of the 3.66 bulge, or 1.14. The expected digraphic I.C. in a Kryha system (1.034 for the original 
machine i considerably less than that of the Wheatstone since there are 
in effect several variant possibilities for the encryption of a digraph after the first letter is determined— 


6 ways for the original Kryha, and 3 ways for the improved model.'!® Cryptograms enciphered by the 
Wheatstone device would be replete with isomorphs at no consistent factorable interval; causal poly- 
graphic repetitions within or between messages (at no consistent factorable intervals) would occur with 
the same frequency as those of a cipherteXt autokey system with a single-letter introductory key (1/26 
of the plaintext rate), since there is only 1 chance in 26 that a plaintext word, for example, would be 
enciphered both times at the same setting of the components; and since the Wheatstone produces 
aperiodic encipherment, no depth would be possible and therefore the kappa test would be inapplicable. 
Cryptograms enciphered by the Kryha machine could manifest isomorphs only at intervals of multiples 





b. The cryptographic principle of the Wheatstone was first employed in the device invented by 
Decius Wadsworth, 50 years before Wheatstone, as mentioned in an earlier footnote. (Fhe Wadsworth 
device is in the possession of the Hamden Historical Society of Hamden, Connecticut.) A number of 
modifications of this principle have appeared, among ‘which may be mentioned the devices invented 
by J.S. Beeman. (1905) and William F. Friedman 11938). In the Beeman device (the first patented 
device embodying,the Wheatstone principle) two disks, each composed of several members for varying 
the sequences of the two components, are mounted side-by-side within a frame and are relatively rotat- 
able through gears containing 36 and 39 teeth, respectively. In the Friedman device, two gears are meshed 
side-by-side, the lettéxs of the plain and cipher components being inscribed on the gears themselves. 

c. The original Kryha machine was manufactured j in three versions: the “standard” model, 10’’X 
8’’x4%"’; the “Liliput™ (sic) model, a miniature version of the standard machine resembling a large 
pocket watch and intercommunicable with the standard ‘model; ont an electric model, intwhich a cipher 
unit is interposed between’ two electric typewriters. “The ‘ ‘new” standard model, sold commercially 
since 1934, incorporated the selector wheel with the 52" adjustable screws. Subsequent ‘Kryha patents 
covered three other versions: one in which the plait ang cipher components were carried.on two endless 
metal tapes; one in which the ‘selector wheel was. composed of various interchangeable sectors, each 
having a different numbet of gear teeth or irregularly spaced stop holes so that the user could assemble 
his selector wheel according to different specific keys; and one in which there were two selector wheels, 
one controlling the irregular displacement of the plain component and the other controlling the dis- 
placement of the cipher component. °, » . 

d. The principle of the Kryha machine is found, with slight variations, in several: other devices, 
among which may be mentioned the ones‘invented by the. following: Peter G. G. Beyer (1931) of Copen- 
hagen, whose device was sold commercially by The.Danish Cipher Machine Co., Ltd.; Beue Tann 
(1934) of Chungking and Washington, D.C,, whose device was called the “Comet” methine: Ernesto 
Cristofani (1935) of Rome, Italy; and Jean Frangois Joseph Dupouy (1935) of France.-Some of these 
were only slightly larger than a pocket watchy similar. ta the “Liliput” model sold by Kryha; others, 


10 The way these digraphic I.C.’s are calculated may pe of intefest. For the original Kryha pnahivies the 17 key skips 
have a distribution of four 5’s, six 6’s, four 7’s, and orle eaclt “of 8, 9, and 10. The y I.C. of this distribution 


is St TSO) 1.47; dividing the bulge .14 for the genéral cage (as in the Wheatstone) by 6/1.47 gives .034, so the 


digraphic ee is approximately 1.034. For the improved Kryha meehine, the 52 key skips have a distribution of 31 3’s, 


2 2 
19 4’s, and two 5's, The 7 I.C. i Bee 1.47 again; dividing the bulge .14 by 3/1.47 gives 0694 so the digraphic 


I.C. here is approximately 1.069. 
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_ like the Kryha electric model, connected two solenoid-operated typewriters which printed the plain- 
text and ciphertext copies simultaneously. Some were nonprinting, while others printed on a tape or on a 
. sheet of paper. In the Beyer device (one was a pocket model and another a larger, electromechanical 
machine) the plain and cipher components are irregularly displaced relative to one another according 
to a key sequence generated by two selector wheels, the one for the plain component having 58 teeth 
and 9 fixed stop pins, the one for the cipher component having 62 teeth and 10 fixed stop pins. Both 
components are displaced twice between encipherments, before and after the depression of an operating 
plunger, the amount of displacement being proportionate to the distance between two adjacent pins 
on a selector wheel. The ‘Comet’ machine incorporated two mixed cipher sequences of 13 letters each 
which are slid relative to one another and against a mixed plain component in accordance with a key 
generated by a pair of 19- and 23-sector cam wheels. The period is either 13 times or 26 times the least 
common multiple of the product of the number of sectors in the two cams. The Cristofani Cryptograph 
incorporated a set of 10 small variable-pin wheels of different sizes (the patent drawing shows two each 
of sizes 8, 9, 10, 11, and 12) arranged in a circle around the cipher disk. All the pin wheels advance one 
step between encipherments, and the cipher disk is displaced from zero to five positions at each opera- 
tion. The Dupouy tape-printing device incorporated a keying disk of 95 segments, any one of which 
could be removed to form an irregular pattern of stopping points for the rotating cipher component. 

e. One further point might be brought out in connection with the analysis of the Kryha machine: 
the descriptive brochure accompanying it suggested the use of plaintext interruptors as an added security 
measure."! With the machine were furnished two sets of 26 black-on-white metal tab inserts for making 
up the plain and cipher components, and another set of 26 red-on-white tabs from which a letter (or 
letters) could be selected for the plaintext interruption. After enciphering the designated letter, an 
extra displacement would be imparted to the cipher component, thus interrupting the cycle. Causal 
isomorphs could still be produced, however, and through them the cipher component could be 
reconstructed. 

(1) Let us now suppose that we have the following message at hand, known to have been enciphered 
on the original Kryha machine and suspected of beginning with the opening stereotype “REFERENCE 
YOUR MESSAGE NUMBER . . .”: 


SHVTT JTNHD YIDTI PUJTY XQGGW V 
CLIFP ZNNCW TSCPO SDHKA FSMBG P 
JGUOD GBOHD OOCJW 


Let it further be assumed that we have recovered the cipher component through isomorphs and found 
it to be the QUESTIONABLY keyword-mixed sequence: 


QUESTIONABLYCDFGHJKMPRVWXZ 


RFGR 
XTLV 


Since two long isomorphs within a single message were at an interval not a multiple of 17, this indicates 
the possibility of the use of a plaintext interruptor procedure. Now if there is a single plaintext interruptor 
and that letter is T,, for example (or for that matter any other letter not in the assumed crib), the 
matched plain and cipher would be written out as shown in Fig. 110a, below. If the interruptor letter 
is E,, the write-out would . as shown in oe 1108. 


5 17 5 10 15 17 
REFERENCEYOURMESS RE-FE-RE-—-NCE-YOUR 
SHVTTJTNHDYIODTIPU SH VT T J TNH DYID 
AGENUMBER ME-~-SSAGE-NUMBE-R 
JTYXQGGWYV TI PUJTY XQGGW V 

FicureE 110a Figure 1106 


1 The mention of an added security measure is strange indeed, since the machine was already touted as having an 
incredibly high (i.e., infinite) security. Dr. Georg Hamel, Professor of Mathematics at the Technische Hochschule in 
Berlin-Charlottenburg, wrote a paper entitled ““‘The Kryha Coding Machines: A Mathematical Opinion,” in which he 
gave the number of ways in which a message could be enciphered as 2.29 108; ‘‘Thus, if every person on earth (say 
2,000,000,000 people) bought the machine then each of them could have 1.14 10% independent keys without two persons 
ever having the same system.’’ By comparison, the number of atoms in the universe, 3X 10’ (personally vouched for 
by Sir Arthur Eddington), is only 26 times as large. 
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(2) In Fig. 110@ we note the cipher equivalents of E, in REFERENCE: 


12345 678 9 
REFERENCE 
SHVTTJITNH 


The interval on the known cipher component between H, (at position 2) and T, (at pos. 4) is 14, certainly 
possible when two skips are involved as may be seen by referring to the skip pattern of the original 
Kryha machine (at skip nos. 7, 8, or 16): 


No: 11 12 13 14 15 16 17 1 


Skip: TETSETEBSEIOS657659 


(It may be seen that for two skips, the minimum interval is 11, the maximum 16; for three skips, the 
minimum is 16, the maximum 24.) The interval between T, (pos. 4) and J, (pos. 6) is 13, again quite 
possible for two skips; but the interval between J, (pos. 6) and H, (pos. 9) is 25, an impossible figure 
when only three skips are involved. Thus not only is T, rejected as an interruptor, but it means that the 
interruptor letter must be one of those in the word REFERENCE. We now note in Fig. 1100 the cipher 
equivalents of E, in REFERENCE, on the trial that E, is the interruptor letter. 


3 4 6 9 
-F 
Vv 


7 8 
-RE- 
T J 


_ 


0 
N 
T 


e 


1 


Gy 


1 
R 
SH 


Hie 
= S 


C 
N 
The interval between H, (pos. 2) and T, (pos. 5) is 14, and there is no way to arrive at this number with 
three skips; in the next pair of letters, T, (pos. 5) and J, (pos. 8) are at an interval of 13, which like- 
wise is impossible to make with three skips; thus E, is also eliminated as a possible plaintext interruptor. 
By continuing this process, all letters are eliminated as interruptors except C, and N,. 


(3) The write-outs of the matched plain and cipher for the assumptions of C, and N, are shown in 
Figs. 110¢ and d, below 


-_ 


7 


5 10 15 5 10 15 17 
REFERENC-EYOU MES REFEREN-CEYOURM S 
SHVTTJMTN HDYI TIP SHVTTJT NHDYIDT P 
SAGENUMBER SAGEN-UMBER 
UJTYXQGGWV UJTYX QGGWYV 

Figure 110c Ficure 110d 


In Fig. 110c the interval between Y, (cel. 4) and W, (col. 9) is 12 on the cipher component with five 
skips involved; but since the 17 sets of five consecutive skips on the Kryha selector wheel total to 3, 5, 6, 7, 
8, 9, and 11 (mod 26), C, is ruled out as the interruptor. In Fig. 110d, the interval between H, and W, 
in col. 10 should be +7 on the cipher component which it is, thus proving that N, is the interruptor 
letter. Now the cipher equivalents of SS, at cols. 17 and 1, P, and U,, are at an interval of 7 on the 
component; since there are only four 7’s in the keying sequence (at positions 1, 3, 6, and 14 of the selector 
wheel) the correct key must be one of the following, where position 1 of the keying sequence has been 
ringed : 


§ 10 15 17 
(1) 67567686105657659@ 
(3) S67686105657659M67 
(6) 686105657659M67567 
(14) 659@M67567686105657 
REFEREN-CEYOURMES 
SHVTTJT NHDYIDTIP 

SAGEN-UMBER 

UJTYX QGGWV 
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’ The cipher equivalents of the two R’s in REFERENCE, S, and T,, are at an interval of 1 on the cipher 
component; and since the sums (mod 26) of the first four key values in the four key streams above are 
24, 24, 4, and 1, the last key (6 5 9 7 . . .) is obviously the correct one. From the initial crib we are able 


-~Y..RAU..CBEFG..MNO..S5T...., 


to piece together a partial plain component, which enables us, since we know both the keying sequence 
and the identity of the plaintext interruptor, to decipher portions of the message as follows: 


5 10 1% O17 
6S597TET5ETEBSSbIOSEST 
J IDT 
EN - URM 
FGR 
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From here on we can easily decipher the rest of the message and recover the plain component in its 
entirety. 
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56. Convenient sources of key.—a. In literal and digital cryptosystems of the additive family 
(ie., true additive, subtractive, and minuend systems) using long keys the key is sometimes derived 
from a source easily available in the public domain, either in order to lessen the problems of key pro- 
duction and distribution or to avoid the possession of possibly incriminating materials when used by 
secret agents. Digital key from open sources has been taken from telephone directories (in this case an 
indicator might show the starting page, or the starting name), from statistical tables such as those found 
in ordinary almanacs, from tables of mathematical functions,' or from published tables of random num- 
bers; these might be used with an indicator to show the starting point for the key. Literal key from open 
sources has often been taken from the pages of a novel or other book, again with an indicator procedure 
to show the starting point for the key to be used. The enciphering components in these cases have 
usually been direct or reversed standard alphabets.) Other convenient sources of digital or literal key 
that have been used are old plaintext messages, and old cipher or code messages. 

b. The plain text used as key might be subject to variation: for instance, only every other word 
might be taken, or one- and two-letter words might be ignored, or only the first two or three letters of 
each word might be used; or, in the case of key from a book, only, say, the first five letters from each 
line might be used, or only the first five columns of letters on each page (as measured from the left- 
hand margin). In a specialized case of running plain text used as key only the 20 consonants were used, 
dropping the six vowels. When mathematical or other tables are used as key, the normal direction of 
reading the groups might be changed; or every 5th group, say, might be deleted. In the case of old cipher 
or code messages, every other group might be taken as key, or the columns of groups of a standard 
message format (e.g., ten groups per line) might be taken off vertically from right to left. 

c. The scrambled sequence of code groups in the encode section of a two-part code book has been 
used as key, with an indicator to show the starting point in the sequence. The code groups have been 
read in the normal fashion down the column, or sometimes up the column; and sometimes the individual 
code groups have been reversed. 

d. Other keys have either been gererated by some deterministic method, manual or machine, or 
have been produced in a random fashion in bulk and put together in key books of convenient size for 
the users. Some of these methods will now be discussed. 

57. Manual key generation methods.—a. There are many schemes for the generation by hand of 
long literal keys. For instance, in a basic 26-letter mixed sequence the letters in the sequence up to A 
might be taken, followed by the letters up toB, C . . . Zasin the following example: 


HYDRA/HYDRAULICB/HYDRAULTI C/H ¥Y D/. 


This yields a key of length ee) = 351. 


11f these are 4-digit tables, a simple expedient that has been encountered for producing 5-digit key is by repeating 
the last digit. 





—SECRET- 
b. Another scheme involves the 26 slides of a basic sequence, 
AULIC...ZHYDR/BEFGJ...AULIC/CBEFG...RAULI/DRA..., 


yielding a key of length 676. A simple variation of this idea is reversing the sequence of letters in the 
B,D, F . . . segments: 


AULIC...2ZHYDR/BCILU...KJGFE/CBEFG...RAULI/DYH. 


c. In another method for producing a 676-element key, 


HYDRAULICBEFGJKMNOPQSTVWX2Z 
IZESBVMJDCFGHKLNOPQRTUWXYA 
JAFTCWNKEDGHILMOPQRSUVXYZB 
KBGUDXOLFEHIJMNPQRSTVWYZAC , 


a basic 26-letter mixed sequence is succeeded by 25 isomorphic changes, either on the normal sequence 
as in the example above, or on the same mixed sequence (which amounts to nothing more than a simple 


slide), 
HYDRAULICBEFGJKMNOPQSTVWXZ 
YDRAULICBEFGJKMNOPQSTVWXZH 
DRAULICBEFGJKMNOPQSTVWXZHY 
RAULICBEFGJKMNOPQSTVWXZHYD. ; 

or on an unrelated sequence, 
HYDRAULICBEFGJKMNOPQSTVWXZ 
JCFVBEYODLSGHKMPANRUTIWXZQ 
KDGWLSCNFYTHJMPRBAVEIOXZQU 
MFHXYTDAGCIJMPRVLFWSONZQUE. 


d. In the following method, 


HYDRULICB...XZ/HYDRAULICEF...XZ/HYDRAUL 
IBEF...X Z/HYRAULIC...X¥Z//HYDRAULICBF..., 


a basic 26-letter sequence is transformed into 26 sequences of 25 letters each, by first dropping out A, 
then B,C . . . Z, yielding a key of 26X25=650 letters. Here again a possible variation is the reversal 
of the sequence of letters in the 2d, 4th, 6th . . . segments. 

e. Another method that has been proposed is writing the normal alphabetic sequence (or an agreed- 
upon mixed sequence) a fixed number of times under a transposition key, and taking off the columns of 
letters according to the numerical key. An even better idea is a double transposition, as in the following 

















example: 
BERNESWITZERLAND MANCHESTERENGLAND 
2 4 11 9 § 13 15 7 144 «16 6 «12 8 1 10 3 ll 1 12 3 9 5 16 17 6 15 7 138 8 10 2 14 4 
ABCDEFGHIJKLMNOP NDTJZPFVAQGWMCSIY| 
QRSTUVWXYZABCODEF PFVLBRHXBRHXNDTJZ 
GHIJKLMNOPQRSTUV EUKAQGWMKAQGWMCSH 
WXYZABCDEFGHIJKL XNDTJZPMCSIYOEUDT 
MNOPQRSTUVWXYZAB JZPFVLOEUKAQGWCSI 
CDEFGHIJKLMNOPQR YOEUKLBRHXNDTFVLB 
STUVWXYZABCDEFGH RHXNIYOEUKAQGWMCS 
IJKLMNOPQRSTUVWX IYOJZPFVLBR 
Y Z| 

Tl T2 


| 


228 
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The final key (D F UN Z. . .) is much more thoroughly disarranged than that of the first trans- 
position alone (ND TJ 2Z =. . .) which consists of slides of two 13-letter sequences owing to the 
even length of the transposition key. 

f. Digital keys can be generated in even more simple ways than literal keys. The simplest example of 
self-generated key that has been encountered is a stream composed of an ascending sequence of numbers 
as in the two following examples: 


1011 1213 1415 1617 1819 2021 2223 2425 2627 2829 . 
2502 5125 2253 2542 §525 6257 2582 5926 O0261 2622 . 


Another procedure employed the file time, or the file time plus a sum check, to yield four-digit and 
five-digit numbers which were used in a fashion similar to the examples above. 

g. When digital key is derived from plain text, a particularly popular method involves the use 
of the following diagram for the conversion: 


123456789 0 
ABCDEFGHTIJ 
KLMNOPQRST 
UVWXYZ 


Other schemes frequently encountered entail the use of a monome-dinome rectangle, or a bipartite 
matrix, such as in the following examples: 


9481276503 


0 


REPUBL 
ADFGHJ 
QsSTvVWx 


Ke RH 
NZa 
z 





SOQH RIN 
~O LIQ 9/0 
eM K YS C)O 
NSS OW/O 


6 
LIR 
2\L 
3|F 
4\N 
5|V 





h. In another scheme for converting litera] text from a book into digits, use is made of the following 
widely known memory training device: 


1 2 3 4 5 6 7 8 9 O| 
‘T NM RL s K F P § (W, H, and vowels have no value) 
D CC V Bg 
TH @ ck Z 
TH a G 
Q 
NG 


The conversion of plain language into digits is by sounds, and not by the alphabetical characters, as 
may be seen in the example below:? 


THE CHARGEOFTHELIGHTBRIGADEWAS 
1 6 46 8 1 5 194 7 1 0 
WRITTENBYALFREDLORDTENNYSON 

4 1 29 584 15 411 2 O 2 


? Note that the Cand @ sounds in the word CHARGE have a value of 6, while the G in LIGHT is not counted since it is 
not pronounced, and the G in BRIGADE has the value of 7. 
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1. The methods described in subpars. a-e, above, may also be adapted for the production of digital 
key. As for isomorphic key, using a basic 25-digit key as an example, nine subsequent rows of 25 digits 
each may be produced by adding a 1 or some other constant to each element of a row, 


2154183676852094523417390 
3265294787963 105634528401 
4376305898074216745639512 
548741690918 5327856740623. ; 
or a 10-digit mixed sequence may be used to generate nine further rows,’ 
2£154183676852094523417390 
4689621757284309841965103 
9720746585429130296078631 
054359782 8940613 4073 52716. j 
or a long series of substitution alphabets such as 
1234567890 
(1) 5820169734 
(2) 6195720384 
(3) 6471502839 


might be used to generate a large number of rows from the basic sequence as in the following example: 


2154183676852094523417390 
BS510572696718 430182059234 
1675639202371 485719560984 
4651687020854931547162739 


j. A frequently encountered key-generation method, especially for agent use, entails the use of 
Fibonacci treatment involving an introductory group of length n, and then (most usually) summing 
the a+6 digits to yield the digit in the (n+1) position, summing the b+ digits to yield the digit in the 
(n+2) position and continuing this process to derive a key as long as necessary with which to encipher 
the message. The indicator in such cases is often the introductory priming group disguised by an additive 
(usually taken from one of the text groups of the cipher message) ; in some cases, however, the indicator 
is the introductory group left in the clear, as in the following examples employing 5-digit priming groups: 


Ind. 10 15 20 Message key 
31419 4550390532958: 51 A336576912. 
27188 989677753 442878 6055465090. 


In these two examples the developed key up to the 20th position was discarded as a safety measure, and 
the actual key used commenced with the 21st position. 

k. Fibonacci variations are many. For example, if the introductory group consists of five digits, 
the formulas a+e=f or a+6+c=f might be used; or each succeeding five-digit group might be gen- 
erated by a recursion procedure of a+6b=f, 6+c=g, ctd=h, d+e=i, but e+a=j (instead of the more 
usual e+f=j7). Sometimes a row of n digits, say 25, might be generated by a Fibonacci treatment, and 
a second row established underneath the first one, either by shifting the basic sequence against itself 
at some offset 

3141945503905329585143365 
1945503905329585143365314 


3 The 10-digit mixed sequence in this example, 2490316758, generates nine further rows, but it could be used to gen- 
erate 99 further rows by successive changes of the mixed sequence to 3501427869, 4612538970 . . ., that is, by 
adding to the digits of the mixed sequence after each set of ten rows, yielding a key totalling 2500 digits. ‘ 
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or by adding a constant to the basic sequence, 


31419455039053295851 
42520566140164306962 


or by continuing the Fibonacci treatment for another 25 digits, 


3141945503905329585143365 
TEPIAZZSSV0SH5hS8SSSSFSBILIELIIZAT 7. 


From here on a vertical Fibonacci treatment is applied to the columns, to yield a long key. Using the 
case just illustrated, 


mA 
& Ol 
ID 
aon 


3141945503905329585143365 
TEXP9IZAZZSS5OVOISESSSSBSSBSILILEGEIYVATT 
O7TS2ZI7TOSSSBTSBSBILSFA2ZSIVETSHSLSES2 


the length of the key would be 60X25=1500 digits before it begins to repeat. 

l. Key has sometimes been produced by means of an assembly of strips. The system entails a set 
of, say, 50 strips containing 50 digits each, from which a selection of 20 strips is made, aligned flush 
with each other or at a specified alignment, and the key groups are read in the order in which they 
occur. As an example, in Fig. 111@ below is illustrated a set of ten strips, and in Fig. 1116 is the selection 
of strips 6, f, c, and a at the alignment 3204. (Note that, to avoid possible ambiguity, the top ten digits 
on each strip consist of a scramble of the digits 0 through 9.) 
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The key groups would be taken off starting with 3204 0533 and ending with 3464 7676. If more key 
is needed, a new selection and alignment would be made. (The process could have been facilitated in 
this case by selecting eight strips, taking off two groups at a time.) 

m. A method that has achieved prominence is the use of a stencil with which to extract key from a 
key page, as illustrated in the example given in Fig. 112, below: 
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Figure 112 


The key page in this instance consists of 20 rows of 35 random digits each, and the index position (the 
upper left-hand corner) of the stencil may be positioned at any one of the first 16 digits in the first ten 
rows of the key page (in this example, it is placed at position c5). The apertures of the stencil expese 15 
four-digit groups,’ and it may be used in any of the four positions, two obverse and two reverse. The 
advantage of such a system is the prolongation of life of key pages by means of frequent changes of the 
stencil (size, shape, and number of apertures per line) for different key periods; furthermore, it allows 
considerable flexibility in the choice of a message-to-message keying variable. 

n. As a final comment, keys have been encountered which were produced by a person writing down 
random characters by hand, or with a typewriter. As may be imagined, these ‘‘random characters’’ are 
really not random, since it is inevitable that psychological factors enter into the “arbitrary” selection of 
characters. 

58. Mechanical and electronic key generators.——a. Perhaps the most primitive ‘‘mechanical”’ 
generation of digital key is accomplished by means of printing slugs consisting either of single-digit 
type faces or of 4- or 5-digit groups. The slugs are assembled by hand into a chase or printing frame, and 
two or more copies are printed of several pages simultaneously. For example, in the case of 4-digit slugs 
there would be available a collection of one each of the 10,000 groups from 0000 to 9999, and a printing 
frame of four or eight pages of 100 groups each would be made up at the same time. After the requisite 
number of copies is printed, the used slugs would then be put back into the total collection, scrambled 
thoroughly, and another printing frame of four or eight pages would be made up. 


4 Cases have been encountered wherein the apertures of the stencil expose single digits, these digits comprising a 
periodic repeating key. 
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b. Old teleprinter tapes, either of plain text or cipher text, have been used as keys; or two or more 
tapes have been added together and the resultant used as a composite key. For that matter, even a single 
tape could be read at two different positions and the characters added together to produce key in 
plaintext autokey fashion. 

c. Punched-card equipment has been used to produce key. The simplest method, used for digital 
key, is to take a deck of cards on which is punched either plain language or random alphabetical text, 
and then list the cards but omitting the zone punch (i.e., the §, ‘‘x”, and ‘“‘y” punches). This results in the 
following conversion as a consequence of the card punching code: 


9 


QP |e 
NAR Wir 
a0 "NO 
MID OIA 
NWH 


8 
H 
Q 
Y 


yr ain 
cz Up 
<2 FIN 


Note that a @ cannot be produced because al! letters are coded by a combination of a digit punch from 
1 to 9 plus an ‘‘x’’, “y’”’, or “Q”’ zone punch. 

d. The more usual punched-card method, however, is to start with a single “supermaster card” 
punched in all 80 columns, perhaps with exactly eight occurrences each of the digits 1 through 0. Then 
by means of a plugging, 79 more cards are produced from the “‘supermaster card.’’ These cards are now 
thoroughly shuffled, and 40 or 50 columns are selected by means of a plugging and printed to constitute 
80 lines of key. When the 80 cards have been listed, either the plugging is changed or the cards are shuffled 
anew, or both, to produce further sets of 80 lines of key. Sometimes the ‘‘supermaster card’’ is used to 
to generate a total of 80 “‘master cards,” and these “master cards’’ are then used to produce a second 
generation of 6400 cards which are thoroughly shuffled and from which a selection of, say, 2500 cards is 
made, after which columns are selected and listed as before. 

e. Mechanical key generators have often employed a multiplicity of gears or variable-pin wheels 
with which to produce a long key. The best example of this type of key generator is the Hagelin C~38 
cipher machine, which has six wheels of mutually prime lengths (26, 25, 23, 21, 19, and 17) which step 
once with each operation, so that the cycle is the product (101,405,850) of the wheel sizes. The same 
idea is applicable in the case of key generators employing several teleprinter tapes of mutually prime 
lengths. Other geared devices have used the principle of the Kryha cipher machine, involving a gear 
which moves irregularly, displacing a pair of enciphering components from 5 to 10 steps; after a cycle 
of the gear wheel (which can be varied, usually in the vicinity of 15 to 35) the sum of the displacements 
is prime to 26 so that the length of the key produced is 26 times the gear cycle. Still other generators 
have incorporated plaintext or ciphertext autokeying, or the principle of the Wheatstone cipher device 
which achieves a highly irregular motion of the pair of enciphering components because the stepping 
is predicated not only on the plain text being enciphered but also on the particular sequence of the letters 
in the plain component. 

f. Often mechanical key generators are employed “‘off line,” so to speak, to produce prefabricated 
key in advance of actual message encryption. For instance, a Hagelin C-38 machine may be used to 
encipher a constant plaintext letter, say Ap, which results in the production of pure Hagelin key; or, by 
prearrangement, plain text from a book or other source can be enciphered, yielding a highly complex 
resultant as key. Furthermore, in mechanical key generators the key produced is sometimes cumulative 
in nature, i.e., each key element is the sum of the key generated at that particular position plus all the 
preceding key elements. 
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g. One device that has appeared on the open market consisted of an array of print-wheels containing 
ten digits each which printed one page at a time, and after two (or more) copies have been printed 
the wheels advance to new positions and another page is printed. In Fig. 113, below, is illustrated a simpli- 
fied sample of two successive pages (as printed) of ten rows of five 4-digit groups each. It will be noted 
that the numbers in the first and fifth groups advanced by 1 between the two pages, the numbers in 


Page 63 Page 64 
0918 2009 3282 3952 0422 0919 2008 3285 3949 0423 
9004 8549 5198 5065 9493 9005 8548 5201 5062 9494 
7318 5020 4767 2626 6229 7319 5019 4770 2623 6230 
7976 ‘7649 2097 8774 9042 7577 7648 2100 8771 9043 
5401 4405 6628 3100 0068 5402 4404 6631 3097 0069 
0835 6991 7854 4278 1366 0836 6990 7857 4275 1367 
2830 0326 8133 1059 4051 2831 0325 8136 1056 4052 
5380 8623 8159 1362 5121 5381 8622 8162 1359 5122 
9175 5374 6161 6226 5026 9176 5373 6164 6223 5027 
8941 9269 0039 5839 1260 8942 9268 0042 5836 1261 
Figure 113 


the second group have retrogressed by 1, the numbers in the third group have advanced by 3, while 
the numbers in the fourth group have retrogressed by 3. (In the actual machine some of the wheels had 
repeated digits; the turnover points were not necessarily 9; and irregular motion was imparted to some 
of the wheels.) In order to disguise the relationship between successive pages, the pages were scrambled 
after a sufficient number was produced, and the pages were bound in individual key books. 

h. Electronic key generators have now come to the fore, as might be expected. Some of them are weak 
in cryptoprinciple; some are merely electronic versions of pin-wheel or gear mechanisms. The more 
sophisticated of them, however, are electronic shift registers which produce binary key for the encryp- 
tion of teleprinter characters, facsimile signals, or coded speech. These shift registers consist of a number 
of cells or stages, initially loaded with 0’s and 1’s for the start of the generation. As each binary key 
element is produced, the sequence of 0’s and 1’s is shifted to the right, dropping out the rightmost bit, 
and the leftmost stage is ioaded with a new bit by some convention in the circuitry. The maximum 
cycle of such a register is 2"-1, where 7 is the number of stages involved. In Fig. 114, below, is a sample 
register of 16 stages. 
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’ The initial fill is 1000 1011 1110 0100; the feedback to stage 1 is the combination of stages 11, 13, 14, 
and 16 by some rule (either mod 2, Vernam, Boolean, or multiplication)*; and the key is the combination 
of stages 10, 12, 18, and 15 by some rule. In this example, if all the combinations are mod 2 the key 
produced will be a 1, while the feedback to stage 1 will be a 0, making the new fill 0100 0101 11110010. 
a. Just as manually produced key may be the result of psychological random by pencil or typewriter, 
likewise there are mechanical and electronic counterparts in nondeterministic key production. There 
have been key generators marketed which operate with ball bearings falling into slots or with balls of 
two different sizes; or the key generated may be produced by the firing of a gas tube, or by emissions 
from a radioactive source. Computer programs with complex jump orders may also be used for the pro- 
duction of digital or alphabetical key that approximates random key. 

59. General analytic approaches.—a. The general methods and procedures of cryptanalysis that 
apply to encrypted text also apply in the analysis of key. Moreover, in key analysis there may be exploited 
properties of its source, generation, or production which are not present in the cryptanalysis of encrypted 
text. When the method of key production is deterministic, solution of the method is possible; but when 
the method is nondeterministic such as psychological random, or involving the firing of a gas tube, all 
that can be done is to apply the principles of astrology with a wet finger held in the air, capitalizing in 
whatever way possible on any key bias or tendencies observed. 

5. Frequency distributions of various kinds, and searches for repetitions and evidence of isomorphism 
are a must. But ahead of these, the recovered key must first be looked at with both eyes and an open mind, 
which makes the derivation of the following key fragment 


AAJVC ODFSH BAJVC AJVCO DAJVC ODFSH. 
recognizable in an instant,® and the derivation of the key fragment below 


HBPYE QDFSR GTAJV UKWLM XINZC OYEQD 
FSRGT AJVUK WLMXI NZCOH. 


apparent after a very brief examination. In the next example of the key recovered from a 50-letter 
message, 


BSJOF WDULQ HFWNI ZQKBS MDUEV MNEVA 
RICTK LCTPG XJARG XOHYP 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


its frequency distribution reveals superflat randomness and suggests a possible method of generation, 
confirmed by noting the plethora of digraphic repetitions and exploiting them to solution, recovering 
the complete key population in the process. Had the method of extraction been different, as for example 
in the following key, 

FW NEVDU TKQ HYPGX FWNEV 
BS JARMD CTE 


LC 
UL 
complete solution would have been achieved by capitalizing on the long polygraphic repetitions mani- 
fested without the necessity of making a frequency distribution. 

c. The common method of converting literal text to digital key through the use of the diagram 
below, with the set of equivalents as shown, 


1234567890 
ABCDEFGHIJ 
KLMNOPQRST 
UVWXYZ 


5 The rules for combining bits are explained in footnote 5 of chapter X (p. 267). 


6 Or two. 
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yields a distinct set of probabilities of the digits, shown below together with the theoretical distribution 
in tally-mark form (for English underlying text) : 


- 1027 
.0614 
.0710 
.1265 
2246 
. 0560 
.0199 
. LO97 
. 13547 
0935 
1.0000 


ON THE TAL DRL PHL IT 
OD TH / 


N/ 
©O TAL TN Hil 


THT 
nN! 
os PN THY I// 
OO PHI TH / 
© MII 


OCOONOUAWANNHE 
OAK // 


The appearance of this distribution (and its equivalent in the language of the particular problem with 
which we might be concerning ourselves) should be memorized, together with its y I.-C. (in this case, 
for English, y=1.28), for its quick identification and interpretation when it is encountered. Once a 
numerical key is recognized as having arisen by means of this particular conversion process, the original 
plain text may easily be recovered by reading on simple generatrices, as in the following example: 


NU I/D 
< O BOI 
am Pl 

wm mio 

MHIO «a 
SEQIN 
HO MIN 

Zw {0 
fe O MI 
aries 
<2 OLA 
Mm ZOLA 

MN HO 
qe O MIO 
arming 
KO BIO 
mam 2 Ol 
HO BION 
Ke Oo fo 
GA Pls 

A lo 

A HIO 
aK Pl 

O QIN 
KO mMINs 
HO min 
GRP le 

Ww Lio 
N ‘Ud "ID 
ax Pls 


d. Cases have been encountered in which key has been generated by enciphering plain text from a 
book through a Nihilist square which consists of a 55 square inscribed with the normal A—Z sequence 
(I and J combined), and coordinates 1-5 in normal order for both rows and columns. This yields the 
following sets of probabilities and theoretical distribution: 





Rows: Columns: Composite distribution: 
1  .2865 1.1572 Sg | = 
2  .1567 2 .1422 ZszZBzZ |s=x ZEB 
3 . 2426 3 . 2099 ZZBB Ze l|ZBZZZFZ 
4 , 2084 4 . 5040 12345\/12345 
2 0558 5 1867 Rows Columns 
1.0000 1.0000 


The nature of the dinomic key text, revealing plaintext properties underlying, makes it very easy to 
recover the original literal text from which the key was produced. Other schemes for obtaining digital 
key from plain text, such as encipherment with monome-dinome rectangles, are transparent and readily 
solvable if there is a sufficient sample of key available. Furthermore, there have been many cases in which 
key was derived from plain text enciphered by means of the same cryptosystem as was used to encipher 
the message.’ For example, if the enemy is using the following monome-dinome rectangle, 





? For an example of such a system used by secret agents in World War II, see pp. 206-210 of Alexander Foote, Hand- 
book for Spies, New York, 1949. 
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this yields, for English plain text, the probabilities of the ciphertext digits (with y I.C. of 1.63) and the 
theoretical distribution in tally-mark form shown below: 


. 2880 
. 0363 
0372 
. 1808 
. 1468 
.0354 
0602 
.0268 
. 0923 
0962 
1.0000 


© PAN PNT THU TY TW IIIT 
Ga FAN PA DHL TIT 

ws THI PHL THI 

On iif 

OIA f 


Nil 
Co TH I/II 
© PME TY 


F //i/ 
viii 


OANDUIAANNE OO 


If, in solving an additive encipherment involving the foregoing rectangle, we recover the first 30 digits 
of key to be 


08031 93450 39409 00043 44314 00364 


we would recognize from the appearance of the key that it must be derived from the same population 
as the theoretical distribution given above; this is attested by the distribution of the key: 


© PH Tilt 


be // 
CA / 
NII 


o1/ 
Oy/ 
~} 
oO 
© Ii 


2 


Even if we had recovered the following key, 


68670 97326 79369 66637 33703 66743 
= ~ z = z = ~ 5 
0123456789 


we would still recognize from its appearance that it must be based upon plain text, and, because of its 
y I.C. of 1.75 (close enough to the y I.C. of 1.63), probably enciphered through the same monome- 
dinome matrix but with different coordinates. This is a hypothetical case, of course, but it might be 
apropos to include here the digit probabilities and theoretical distribution of cipher text produced by 
the true Nihilist system, involving an additive key produced by enciphering plain text through the same 
square as is used for the encryption of the message: 


.0190 
. 0000 
.0450 
.0753 
.1218 
. 1897 
. 1834 
.1617 
1527 
0715 
1.0001 


nO 

ON THI Tif 

WS THETA TI 
ON DHE PKU THY THI 
OD FAL XE THE TH 
NUT THU THI 
00 TW THI Ii! 
OMT 


OMNOAARANH OS 
ol 
| 
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e. The punched-card method of producing digital key by suppressing the zone punch of alphabetical 
material yields characteristic probabilities which are easy to recognize and interpret. In Fig. 115a, 
below, are the probabilities 








0 . 0000 0 .0000 
1 .0753 1 .0769 
2 .0739 2 .1154 
3 . 1590 3 1154 
4 0931 4 1154 
5 2248 5 .1154 y 
6 .1192 6 1154 ; 
7 . 0477 7 .1154 
8 . 0567 8 .1154 
9 .1503 9 1154 
1.0000 1.0001 
Ficure 115a Figure 1156 


of the digits when the data punched on the cards is English plain text, and in Fig. 1156 are the prob- 
abilities when the data consists of random alphabetical characters. In tally-mark form the theoretical 
distributional appearance of these two cases is quite striking: 


_ = 
B= ZS22 _2 = 22222 ZZZ 
Z2Z22BZZZZZ Z2Z2ZBZZZZZ 
0123 456789 0123456789 
Figure 115¢ Fiagurt 115d 


The original plain text from which the key was derived may be easily recovered with a modification of 
the generatrix diagram shown in subpar. c, above. 

f. Delta techniques play an important part in key analysis, as will now be shown. For example, if 
key recovered on true base from a cipher text were that given below, 


3201 3404 3598 3784 3962 4133 4298 4456 4609 4757 .. ., 


this appears to have been derived by some sort of mathematical progression or from a table of mathe- 
matical functions. A search in common mathematical tables reveals the source: in a table of 4-place 
logarithms, these are the logs of 209, 219,229. . . . But if the key were not on true base, so that 
the groups as recovered were 


4435 4638 4832 5018 5196 5367 5532 5690 5843 5991 .. ., 


this sequence could not be found in any of our available tables. We therefore take first differences (with 
borrowing subtraction) of the groups, and also further differences as shown in the diagram below: 


4435 46358 4832 5018 5196 5367 5532 5690 5843 5991 . 


At: 203 194 186 178 171 165 158 4153 + 148 
de: 9 8 8 7 6 7 5 5 
As: =i O..'< 22, er i. <2 0 


“1 
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The oscillation of the final differences is indicative of derivation from a mathematical table of some sort, 
with round-off error because of incomplete information. We therefore make a search in available mathe- 
matical tables for groups with successive differences of 203,194,186 . . ., which leads us to solution, 
discovering the addition (with carrying arithmetic) of a constant 1234. Note that if we had taken our 
first differences mod 10, we would have had the following: 


4435 4638 4832 5018 5196 5367 5532 5690 5845 5991 . 
Ay: 203 204 1286 188 271 275 168 #253 £158 


These fluctuating differences would have caused us to try normal arithmetical differences instead of 
mod 10 ones, leading to solution as before. 
g. In Figs. 116a@ and 6, below, are given two further examples of key and differences: 


K: 23235 2530 2755 2998 3259 3538 3835 4150 4483 4834 . 


A: 207 225 243 261 279 %297 315 333 351 
Ap 18 18 18 18 18 18 18 18 
As: 0 0 0 0 0 0 0. 


FIGURE 116a 


K: 5818 6215 6684 7231 ‘7862 8583 9400 0319 1346 2487 . 


A: 397 469 547 631 T2l 817 919 1027 1141 
Ae: T2 78 84 90 96 102 108 114 
As: 6 6 6 6 6 6 6 
Ay: 0 0 0 0 0 0 

Ficurer 1)66 


The fact that the last differences are all 0’s shows that the numerical data are self-contained and com- 
plete. Now it is a well-known mathematical fact that the second differences of a series of squares (or 
any decimation of the series) will be constant, as will be the third differences of a series of cubes, as may 
be seen from the following: 


N N? A, Ap N NB oA As As 
1 1 1 1 

2 4 32 2 8 7 12 

3 9 5 2 3 27 19 18 6 
4 16 7 2 4 64 37 24 6 
5 25 9 2 5 125 61 30 6 
6} 36 11 6 216 91 

Figure 116e Figure 116d 
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It therefore follows that the key in Fig. 116a@ is based on polynomials of the second degree, so we can 
solve a set of four simultaneous equations in four unknowns to arrive at an answer, as follows: 


(1) ax? +bx +c—2323 
(2) a(x+1)?+b(x+1) +c=2530 
(3) a(x+2)?+b(x+2) +c=2755 
(4) a(x+3)?+b(x+3)+c=2998 


(2) (ax?+2ax+a)+(bx+b)+c=2530 


(1) _ax? + bx +c=2323 
(5) 2ax+a +b = 207 


(3) (ax’?+4ax+4a)-+ (bx+2b) +c=2755 
(2) (ax?-+2ax+ a)t(bxt+ b)+c=2530 
(6) 2ax+3a +b = 225 


(6) 2ax+3a+b=225 
(5) 2ax+ atb=207 
(7) 2a =18, . a=9 


At this point we are in a quandary, since there is no clear-cut way to recover the values of z and b— 
indeed, there is an infinite set of values for z and 6 that will satisfy the equations. But let us try a bit 
of practical skulduggery. We see from (5) that 18x+9+b=207, so that 18x+b=198. Now since 18 is 
a divisor of 198, is it not possible that z=11, making 6=0? We then have the first several elements of 
key reduced as follows: 

1. 2323=9-11?+1234 

2. 2530=9-12?+ 1234 

3. 2755=9-13?+ 1234 


Even though there is an infinite set of values of z and 6b that would satisfy the equations, there is little 
doubt, based on psychological considerations, that the values are a=9, 6=0, c=1234, and r=11. As 
for the key of Fig. 1165, we must solve the following set of five simultaneous equations in five unknowns: 


(1) ax? +bx? +ex +d=5818 
(2) a(x+1)?+b(x+1)?+ce(x+1)+d=6215 
(3) a(x+2)?+b(x+2)?+e(x+2) +d=6684 
(4) a(x+3)?+b(x+3)?+e(x+3)+d=7231 
(5) a(x+4)?+b(x+4)?+ce(x+4) +d=7862 


Here too there is an infinity of answers, but the psychologically most plausible one consists of the values 
a=1, 6=0, e=0, d=4487, and x=11, simplifying the polynominal to x?+4487. 

h. For the next case to be considered, we have the following stretches of key recovered from reading 
three shallow depths (the message indicators are shown enclosed within parentheses) : 


Key “A” 

(14342) 21900 30109 41280 71216 24400 93326 46025 41671 . 
Key ‘B” 

(09414) 28071 21624 40093 32646 02541 67110 51010 31452 . 
Key “C” 


(16715) 10510 10314 52188 22534 11141 87119 82119 71041 
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It'is apparent from the relationships of the three keys that the sequence of 5-digit groups may be used 
at a slide. On closer examination, however, it is observed that if the keys are divided into tetranomes, 

the a digits are limited to 0, 1, or 2: this could mean that the enemy is using the encode section of one 
’ of his two-part code books as source of key. As for the indicators, they designate the group (with a sum- 

checking digit added) immediately preceding the first code group to be used as key. The beauty of this 
- scheme to the cryptanalyst is that, if the code is still in use and has not been recovered to any extent, 
. the sequence of key groups recovered above had the effect of transforming portions of the two-part 
- code into a one-part code.* 


4. In the next example let us assume that we have the following three keys available for study: 


(1) 3204 0533 1149 8992 7386 9857 5575 6010 4927 0668 . 
(2) 2601 3438 0744 1093 8289 7552 9176 5917 6325 4860 . 
(3) 3871 9508 2727 6159 7215 5696 0734 7680 8355 0002 . 


We note, between keys (1) and (2), that the a digits of (2) are the same as the a digits of (1), but at a 
slide of 1; that the 6 digits of (2) are the same as the 6 digits of (1) at a slide of 4; that thee digits of 
(1) and (2) are identical; and that the d digits of (2) are the same as the d digits of (1) at a slide of 2. 
Likewise, it may be seen that the a digits of (1) are related to the d digits of (3); the 6 digits of (1) are 
related to the c digits of (3); the ¢ digits of (1) are related to the } digits of (3); and the d digits of (1) 
are related to the a digits of (3). All this points to a system of generation with sliding strips, such as that 
illustrated in subpar. 57/, so that after the strips are synthesized the key for a new message could be 
extrapolated after a few groups have been recovered. 

j. In another example Jet us study the following three keys recovered from the initial analysis of a 
cryptosystem : 


(1) 3153 8980 3335 6013 9228 6140 0117 4159 4938 7607 . 
(2) 6315 6898 4333 3601 0922 4614 2011 0415 1493 4760 . 
(3) 3072 0935 5135 3909 8677 0620 7452 9566 8194 7246 . 


We immediately note that the abe digits of (1) are the same as the bed digits of (2), and that the d digits 
of (1) are the same as the a digits of (3). At this point we might have conjectured a strip-generated 
system such as that of the preceding subparagraph, but the fact that no slides of the basic sequences 
between groups is noted suggests a stencil system, upon which we are able to synthesize the following 
partial sequences of the key page: 


. 631535072 . . . . . . 68980935... . . . 43335135 . 
. 36013909... .. . 09228677 . . . . . . 46140620 . 
. 20117452 ... . . . 04159566... .. . 14938194 . 
. 47607246 . 


As more key is recovered it can be fitted into our partial reconstruction, and we would eventually arrive 
at the key page and stencil shown in Fig. 112. In this case the solution of the indicators used would 
materially aid in the correct interleaving of the odd and even rows of the key page, since the stencil 
itself has its apertures two rows apart. 


8 In a related use of code books as sources of key, cases have been encountered in which the indicator in a trans- 
position system consists of a code group (for example, LYUF, which might have the meaning ‘“‘Mission accomplished,” 
providing a 19-element key for the transposition). When the literal key is recovered from the numerical] key used in the 
transposition, we also have an incidental code recovery for the group in question, if we did not have it before. 
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k. The key recovered from multiple anagramming of several identical-length transposition messages 
in the same key yields a partial cipher-to-plain (C—>P) sequence which gives clues as to the nature of 
the transposition system. Let us take the following four 50-letter messages as an example: 


5 10 15 20 25 30 
Msg No.1: NURILORRHMHTDTEEOTGARUUDEIDINO 
Msg No.2: IPSLTOLLNOXTREIURNHLYSTENAOTTA 
Msg No.3: TYTPOIERRIEENRUNSPNRONHBATITRGOA 
Mse No.4: EONSRSLUFEUTNTTEROSLRNUPOAFATR 
35 40 45 50 
Msg No.1: HNVDMEZIINACAETATSER 
Msg No.2: ERUCSCIEQEHEEOILRYIT 
Msg No.3: ETSWGNRSLEEKPONTAAOT 
Msg No.4: TROWQPIEPERSTOIOOYST 
In the initial anagramming, 25 columns have been assembled, as shown below: 
41 10 35 23 1 4 14 26 17 29 45 7 20 38 32 48 42 11 3 24 2 6 15 27 18 
Msg No.1: AMMUNITIONTRAINSCHEDULEDT 
Msg No.2: HOSTILEARTILLERYEXCEPTION 
Msg No.8: EIGHTPRISONERSTAKENBYOURP 
Msg No.4: REQUESTARTILLERYSUPPORTEFO 
The partial CP sequence recovered in the foregoing diagram is the following: 


6 10 15 20 25 
41 10 35 23 1 414 2617 29 45 7 20 38 32 48 42 11 36 24 2 5 15 27 18 


It is clear from the isomorphic repetition manifested in the key beginning at the 17th position, that, 
unless blank cells are encountered later on, the system is a single columnar transposition involving 16 
columns with the numerical key as shown in the diagram below, constructed from the recovered portion 
of the CP sequence: 


440 (12 Bk UY HC TH 
41 10 35 23 1 414 26 17 29 45 7 20 38 32 48 
42 11 36 24 2 5 15 27 18 


If, in another example, the portion of the recovered C—+P sequence had been the following, 


5 10 15 20 25 
10 24 2919 35 615 41 46 11 1 25 30 20 36 16 42 47 2 26 31 21 37 7 (17, 


the interrupted isomorphism observed is indicative of blank cells in the matrix, and the numerical key 
together with the blank pattern thus far recovered for the matrix of 10 columns is shown in the following 


diagram: 
3 1 6 7 5 8 2 #4 9 10 


10 @ 24 29 19 35 6 15 41 46 
11 1 25 30 20 36@16 42 47 
@ 2 26 31 21 37 717 





If, as a third example, the C-+P sequence recovered in the process of multiple anagramming had been 
the following, 


15 20 25 

17 56 40 06 30 82 98 80 20 86 60 12 46 70 44 93 50 24 75 01 34 90 65 05 97 
40 45 

39 55 16 54 29 59 69 85 19 79 09 11 23 33 49 92 43 63 74 96 15 04 64 89 27 
65 70 7 

38 68 78 58 28 53100 84 32 42 22 10 08 72 48 14 88 95 73 62 36 03 77 52 67 
90 95 100 


37 26 18 57 41 07 31 83 99 81 21 87 61 13 47 71 45 94 51 25 76 02 35 91 66 


the isomorphic repetition beginning at the 78th position shows that double transposition with keys of 
lengths 7 and 11 must be involved, since 77 is an implausible key-length for single transpositions. 
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i. Slug key is usually produced by selection from a universe, say 10,000 for 4-digit slugs, comprising 
in this case all the groups from 0000 to 9999. When several pages are made up at the same time for 
printing, it is obvious that there will be no repetitions of groups between the pages since the population 
consists of unique slugs,. all different. This absence of repetition between a set of pages permits us to 
conjecture the slug method of production, as may be seen by referring to the table below: 











Probability of 0 tetranome repetitions 
_ 

N | 1 chance in N 1 chance in 
50 - 300 93 
100 Ae 350 483 
150 3 400 3, 257 
200 7 450 28, 492 
250 23 500 323, 857 











(*=88 chances in 100; **=61 chances in 100) 





Tf, for example, we have four sets of 100 tetranomes each and we observe no group repetitions among 
them, and since this phenomenon is expected, by chance, only once in 3257 times, it is obvious that some 
kind of selection without replacement is involved, and slug key comes to mind, with four pages being 
assembled at a time.*® The slugs are then replaced by the clerk, and four more pages are assembled. 
Sometimes, however, the slugs are not replaced after the first four pages, and another set of four pages is 
made up from the remainder, which makes the phenomenon even more striking. Again, sometimes the 
slugs from four pages are not replaced into the population, but are scrambled among themselves to 
yield four new pages, consisting of the 400 groups comprising the previous set of four pages; although 
this key is nondeterministic, nevertheless it is of considerable help to the cryptanalyst, who needs to 
consider only a finite number of possible keys during exploitation instead of the total population of 
10,000. 

m. In the usual punched-card method for key production, a permutation is applied to the elements 
of a master card or cards to produce secondary cards. As an example, let us consider the following master 
card, which for simplicity’s sake has only 30 columns punched, 


5 10 15 20 25 30 
18439267507804912563971025468 3 
and let us assume that the plugging for the punching permutation is 


01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 
04 11 14 06 09 26 30 25 16 01 23 28 19 18 20 10 03 22 05 29 


21 22 23 24 25 26 27 28 29 30 
eT OT 21 13 02 12 15 08 17 24 


The first five elements of the master card would be permuted as follows on the secondary card: 





° The possibility of generation by punched-card methods, with the cards containing one group each, should not be 
ignored. 
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The total number of cards generated from the permutation above (including the master card) is 30, and 


these are shown in Fig. 117, below:"° 


gemnornytnuoa 


1 
7 
8 
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t-ODMDNONMAO 
ornrtyt rom 
NODONM ORM 
NMHOHMND WO 
YOHr ONL OO 
YROMNAYO 
NErowmnnNnonne 
ODWMUNNYMHOH 
NOY ODAK ON 
on NADOOM 
Araoanrnrowodn 
DNONMHAOANM 
aAaranrowadnn 
NHMODOMNOrNY 
YROMOYRDN AK 
AranrroannNnnrnn 


15 20 25 
184392675078 04912563971025468 


10 


6918784955326180 


5 


53142066173 7048 61227550839 
65496523308 0598093 7T7TT7TBEALZ1I211 
0409156392167894754280685238 
S$40454716878521262 93533105979 
Tl262399450053 854778831195 02664 


Mo 


557786162410922468351704933089 
45974322753 81089060 


80229 476430575193 810966834571 
33381267990482541571680264950 
961378851435 4239902850507726416 
470983547962716113290236580458 
9514292481786 007517633684 


Oe ee 


eee ee eee ee 


.) of 30 elements, so a total of 30 distinct 


Ficurr 117 
O01 02 03 04 05 06 O7 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 
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10 The permutation given yields a complete chain (01, 04, 06, 26,12,.. 
16 08 30 26 12 14 23 27 03:17 21 O1 25 24 15 02 28 07 04 05 29 10 09 06 20 22 13 19 18 11 


eards will be produced. If the permutation had been, say 
these numbers, or 210. The “optimum”’ partition of 30 is (11, 7, 5, 4, 3) with a least common multiple of 4620—but 


this yields chains of 10, 9, 7, 3, and 1, so the number of different cards would in this case be the least common multiple of 
this number, far from being a cryptographic strength, is a decided weakness. 


= 


If we assume that for a particular cryptosystem we need key in lines of only 10 digits each, we could 
establish a print plugging, say columns 3-12—-25-8-17-2-19-13-21-5, yielding the listing shown in 
Fig. 118a, below. When the 30 cards have been listed, the print plugging could be changed to, let us say, 
5-30-17-1-4—12-19-23-11-7, producing the listing shown in Fig. 118). Since, however, there are un- 
desirable properties of direct symmetry manifested in the columns of these diagrams, it would have been 
better if we had scrambled the rows of Fig. 117, say to a permutation of 10-4—27-30-1-8-7-3-5-29 ... 
28-6-2—9-26, so that the pluggings for the column selection would have yielded the keys in Figs. 118¢ 
and d. 





3.12 2 8 17 2 19 13 21 5 5 30 17 1 4 «#12 «19 28 1 7 
(1) 4827286099 (1) 9321386676 
(2) 2576820016 (2) 6680150887 
(3) 8268370370 (3) 0731020525 
(4) 3385963680 (4) 0595133274 
(5) 9152486723 (5) 3449516364 
(6) 4023957576 (6) 6496907182 
(7) 9131125467 (7) 7210615058 
(8) 1510734485 (8) 5870054123 
(9) 7901814254 (9) 4383094539 
(10) 8615202824 (10) 4926362914 

%* © &e KF * * &€ & 

(26) 3749691023 (26) 3566771139 
(27) 6891740181 (27) 1978680796 
(28) 7217591530 (28) 0655821840 
(29) 5778415991 (29) 1042575290 
(30) 4682479645 (30) 5043269713 

Figure 118a Figure 1186 

3.12 2 8 I7 2 19 13 2 5 5.30 17 1 4 «12:19 Bu 7 
(10) 8615202824 (10) 4926362914 
(4) 3385963680 (4) O595133274 
(27) 6891740181 (27) 1978680796 
(30) 4682479645 (30) 5043269713 
(1) 4827286099 (1) 9321386676 
(8) 1510734485 (8) 5870054123 
(7) 9131125467 (7) 7210615058 
(3) 8268370370 (3) 0731020525 
(5) 9152486723 (5) 3449516364 
(29) 5778415991 (29) 1042575290 

+ &* & He %¥ & He & 

(28) 7217591530 (28) 0655821840 
(6) 4023957576 (6) 6496907182 
(2) 2576820016 (2) 6680150887 
(9) 7901814254 (9) 4383094539 
(26) 3 49691023 (26) 3566771139 

Fieyre 118c¢ Figure 118d 


Now suppose that we had recovered the 300 digits of key of Fig. 118@ and had further obtained the 
first 50 digits of key of Fig. 118d. It is clear that if we had written the key out in lines of 10 digits each 
we would have noticed not only that the second column of Fig. 118a is identical to the sixth column of 
Fig. 1180, but also that there exist properties of direct symmetry, as previously mentioned, between the 
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columns, speeding up the recovery of the entire 30 basic columns of Fig. 117.1‘ If on the other hand 
we had recovered the 300 digits of key of Fig. 118c plus the first 50 digits of key of Fig. 118d, and had 
again written out the recovered key in rows of 10 digits each, we could extend the first, third sixth, and 
seventh columns of Fig. 118d for a total of 30 positions. What this emphasizes is that writing out re- 
covered key on trial widths may have a rewarding result for the alert cryptanalyst.? 
n. For another case of analysis, let us assume that we have recovered the two following stretches 
of key: 
Key cA” 

0918 2009 3282 3952 0422 9004 8549 5198 5065 9493 

7318 5020 4767 2626 6229 7576 7649 2097 8774 9042 

5401 4405 6628 3100 0068 0835 6991 '7854 4278 1366 

2830 0326 8133 1059 4051 5380 8623 8159 1362 5121 

9175 5374 6161 6226 5026 8941 9269 0039 5839 1260 


Kev “BR” 


0567 5311 1436 1095 1832 3813 3421 0599 9181 8372 
5729 4534 9670 7495 4843 5298 2095 6406 7753 ‘7472 


It is noticed that if Key ‘ B”’ is slid three groups to the left of Key ‘‘A’’, that the a digits in corresponding 
positions are predominantly hitting, or differing by only 1: 

Key “A”: 0918 2009 3282 3952 0422 9004 8549 5198 5065 9493 

Key “B”: 1095 1832 3813 3421 0599 9181 8372 5729 4534 9670 


Key “A”: 7318 5020 4767 2626 6229 7576 7649 2097 8774 9042 . 
Key “B’: 7495 4843 5298 2095 6406 7753 7472 


It is further noticed that the differences (with borrowing subtraction) of the Ist, 5th, 6th, 10th, 11th, 
15th, and 16th groups is 177, and that the differences between the 2d, 7th, 12th, and 17th groups is —177. 
This suggests to us to write out the keys in rows of five groups each, as follows: 


Key “A” Key “BR” 
0567 5311 1436 
0918 2009 3282 3952 0422 1095 1832 3813 3421 0599 
9004 8549 5198 5065 9493 9181 8372 5729 4534 9670 
7318 5020 4767 2626 6229 7495 48435 5298 2095 6406 
7576 7649 2097 8774 9042 7753 =‘TAT2 


5401 4405 6628 3100 0068 
0835 6991 7854 4278 1366 
2830 0326 8133 1059 4051 
5380 8623 8159 1362 5121 
9175 5374 6161 6226 5026 
8941 9269 0039 5839 1260 


11 An interesting observation may be made about the average I.C. of the rows of Fig. 118 (including the missing 
rows 11-25), and of Fig. 118b. For Fig. 118a, since one row has a ¢ count of 2, ten rows have ¢'s of 4, eleven rows have 
¢’s of 6, six rows have ¢’s of 8, and two rows have ¢’s of 10, the 6 1.C.= 270A) oe TSIS/0) 20018) =0.6519. 
For Fig. 1180, the 6 comes out to be 0.7481. The property of an observed I.C. consistently below random is the result of 
the superflatness of the master card, which contains three each of the digits 0 to 9. A selection of any columns from the 
generated cards will always result in an expected average I.C. below 1.0000 for the rows; consequently, this phenomenon 
can be used to diagnose the method of generation of the key. In this case of 30 digits per card, the expected 6 I.C. is 
10(2/29) or 0.6897; if we approached this figure in testing a large number of row distributions, we would know that the 


master card generating the population must have contained 30 digits. 
12 3¢ was emphasized previously that the general methods and procedures of cryptanalysis that apply to encrypted 


text also apply in the analysis of key. In this connection, if key text is written out on width w and the average I.C. for 
this array is considerably improved (let us say, doubled) over the over-all I.C. of the sample, it is indicative that the cycle 
of w has some significance in the generation of the key. 
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We now note that the groups in the third column of Key ““B”’ are those of Key “A” but with an additive 
of 531 (=3-177) while the groups in the fourth column of Key ‘‘B” are those of Key “A” but with a sub- 
tractor of 531. This means that we have two pages of key 177 pages apart, produced by a key generator 
that operates on the following rule, after the 50 printing counters have been set to arbitrary initial posi- 
tions: the counters in column 1 and column 5 advance one position (carrying arithmetic), the counters 
in column 2 retrogress by one position, the counters in column 3 advance three positions, and the 
counters in column 4 retrogress three positions. This conclusion is substantiated by the first three groups 
of Key ‘B”, 0567 5311 1436, which are groups from the immediately preceding printed page, following 
the rule just given. If Key “‘A’”’ were page 1 as printed, then pages 177 and 178 would be the following 
(page 177 is shown in fragmentary form) : 








Page 177 
1094 gee 1832 3813 3421 0599) 
' 9180 heres 8372 5729 4534 9670 
7494 7495 4843 5298 2095 6406 
TT52 7753 7472 2628 8243 9219 


| Page 178 
| 








S577 5578 4228 7159 2569 0245 
1011 1012 6814 8385 3747 1543! 
3006 3007 0149 8664 0528 4228 
| 5556 5557 8446 8690 0831 5298 
9351 (9352 5197 6692 5695 5203 
9117 9093 0567 5311 1436 9118 9092 0570 5308 1437 











We can, of course, reproduce all the pages from 1 to 200 or more, if we desire, with which to read all the 
traffic in the system. 
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. Analysis of key in a double transposition cipher.—-a. Each problem in key analysis is a distinc 
and unique experience, as is indeed any problem in cryptanalysis. Nevertheless, as an example illustrating 
techniques of analysis as applied to key from a manual qryptosystem, we shall study the steps involved 
in the analysis of key derived from multiple anagramming of several identical-length messages in the 
same pair of double transposition keys. But in order to understand the reasons for our steps, we shall 
first examine the mechanics of double transposition entipherment. 

b. Let a 51-letter plaintext message be represented by the consecutive numbers from 01 to 51, 
as inscribed in the T1 matrix shown below. The columns of the T1 matrix are taken off in numerical- 














6 2 7 1 5 3 8 4 a 3 9 1 7 4 2 ll 8 10 6 5 
O1 02 03 04 05 06 O7 08 2 20 28 36 44 02 10 18 26 34 
09 10 11 12 13 14 15 16 42 50 06 14 22 30 38 46 08 16 24 





32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 
51 07 15 235 31 39 47 | 


17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 40 
41 42 435 44 45 46 47 48 
51 

















T2 





Ti : 


key order and inscribed in the rows of the T2’ matrix, and the final cipher text, 20 06 48 33.15. 
(the P—-C sequence) is obtained by taking off the columns of the T2 matrix in numerical-key order. 
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‘Now the P->C sequence, which is an inversion of the C->P sequence obtained from anagramming 
several identical-length messages, is that shown below, together with the delta of the P-C sequence 
which we shall find very useful in a moment or two: 


Term No.: 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 
PC: 20 06 48 33 15 44 30 21 03 39 04 42 32 17 51 36 22 13 49 31 
A: 14 #42 -15 -18 29 -14 -9 -18 36 -35 38 -10 -15 3 -15 -14 ~9 36-18 3 
Term No. 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 
PC: 34 24 09 43 26 16 01 35 28 14 05 41 23 10 46 37 19 12 50 40 
A: “10 -15 34 -17 -10 -15 34 7 14 -9 3 -18 -13 36 9-18 7 BC's - 15 
Term No.: 41 42 43 44 45 46 47 48 49 50 51 
P3C: 25 07 18 08 45 27 02 38 29 11 47 


A: -18 i -10 37 -18 -25 36 5 ~-18 36 


Figure 119a 


There is one 4-element repetition in the delta stream (at term nos. 16-20 and 29-33), and three sets 
of 3-element repetitions. If we write down the fragments of the P—C sequence associated with the 4- 
element repetition and difference these fragments, 


(Term nos. 16-20): 36 22 13 49 31 
(Term nos. 29~33) 28 14 05 41 23 
Differences: 8 8 8 8 8 


we obtain a constant difference of 8, which corresponds to the width of the T1 matriz. If we difference the 
other corresponding fragments we shall likewise find a constant difference of 8. 

c. Now that we have ascertained the width of the T1 matrix, we shall proceed to recover the T2 
matrix. Let us digress for a moment, however, in order to explain the techniques to be employed. We will 
consider the CP sequence obtained from the original multiple anagramming of the messages; this 
is shown in Fig. 1196, below: 


Term No.: 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 
CP: 27 47 09 11 31 02 42 44 23 34 50 38 18 30 05 26 14 43 37 O1 


Term No.: 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 
CP: 08 17 33 22 41 25 46 29 49 07 20 13 04 21 28 16 36 48 10 40 


Term No.: 41 42 43 44 45 46 47 48 49 50 51 
CP: 32 12 24 06 45 35 51 03 19 39 15 


Fieurre 1196 


If we now treat the C->P sequence as if it were the plain text and encipher it through our double trans- 
position keys we will have the following: 


6 2 7 1 5 3 8 4 3 9 1 7 4 2 il 8 10 6 5 








27 47 09 11 31 02 42 44 11 38 01 29 16 06 47 34 43 25 21 
23 34 50 38 18 30 05 26 12 39 02 30 17 OF 48 35 44 26 22 
14 43 37 01 08 17 33 22 13 40 03 31 18 08 49 36 45 27 23 
41 25 46 29 49 07 20 13 14 41 04 32 19 09 50 37 46 28 24) 
04 21 28 16 36 48 10 40 15 42 05 33 20 10 51 





32 12 24 06 45 35 51 03: 


19 39 15 


Tl T2 
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We see that the numbers in the columns of the T2 matrix are consecutive, and that if we were to take off 
these columns according to the numerical key and inscribe them into a matrix of the same dimensions 
as the T1 matrix, these numbers would be consecutive in rows and would represent the sequence of the 
original plain text: 

Ol 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 40 
41 42 43 44 45 46 47 48 
49 50 51| 





d. Returning to our analysis thus far, we have already established the T1 matrix as having eight 
columns, so we inscribe the CP sequence into a matrix of eight columns, as shown below: 








47 09 11 31 02 42 44 
34 50 38 18 30 05 26 
14 43 37 01 08 17 33 22 
41 25 46 29 49 07 20 13 
04 21 28 16 36 48 10 
12 24 06 45 35 51 
39 









We now find the column containing the number 01 and set it down as follows: 
|11 38 01 29 16 06| 


We then look for the column containing the number 02 and set it down under the previous column so 
that the 02 is under the 01, 
{11 38 01 29 16 06| ‘ 
|02 30 17 O7 48 35| 


and we continue this procedure with the columns containing the numbers 03, 04, and 05, arriving at 
the following diagram: 
|11 38 01 29 16 06| 
[02 30 17 O7 48 35| 
|44 26 22 13 40 03| 
|27 23 14 41 04 32 19| t 
|42 05 33 20 10 51| ' 


The next term in the sequence is 06, but it is already present in the diagram, as is also 07. In the column : 
headed by 06 there is vacant space for 08 and 09, and in the column headed by 11 there is space for 12, i 
so these segments are added to the diagram: ‘ 


|11 38 01 29 16 06 
|47 34 43 25 21 12 39/02 30 17 07 48 35| 
|44 26 22 13 40 03/31 18 08 49 36 45| 
[27 23 14 41 04 32 19/09 50 37 46 28 24 15} 
|42 05 33 20 10 51} iz 
h 


It is clear that the diagram is only five rows deep, so we fill out our diagram as follows: 


|11 38 01 29 16 06|47 34 43 25 21 12 39| 
|47 34 43 25 21 12 39/02 30 17 07 48 35/44 26 22 13 40 03| 
[44 26 22 13 40 03/31 18 08 49 36 45/27 23 14 41 04 32 19] 
|27 23 14 41 04 32 19/09 50 37 46 28 24 15] 
[09 50 37 46 28 24 15|42 05 33 20 10 51| 
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We can now draw the outline of the T2 matrix in this diagram, since it is clear from the location of the 
numbers 20 and 25 that the column with the terms 11~15 belongs at the extreme left, and that the 
‘column with the terms 21-24 must be at the extreme right. The transposition key for the T2 matrix 
is established directly from this matrix, the 1 in the key being over the column headed by 01, the 2 of 
the key being over the column headed by 06, and so forth: 

3 9 1 7 4 2 0H 8 0 6 5 


:11 38 O01 29 16 06/47 34 43 25 21: 12 39 
AT 34 43 25 21 {12 39/02 30 17 07 48 35/44 26 22: 13 40 03 
44 26 22 13 40 03/31 18 08 49 36 45/27 23: 14 41 04 32 19 
27 23 114 41 04 32 19/09 50 37 46 28 24: 15 
09 50 37 46 28 24 115/42 05 33 2010 51; — 


At this point we inscribe the CP sequence into the T1 matrix already known to have eight columns, 
and we recover the transposition key by following the sequence of rows in the T2 matrix; thus the terms 
11 38 01 29 16 06 must be under key 1, the terms 47 34 . . . 12 39 under key 2, and so on. The 
recovered key is shown at the top of the T1 matrix below: 

6 2 7 1 5 8 8 4 


27 47 09 11 31 02 42 44 
25 34 50 38 18 30 05 26 
14 43 37 01 08 17 33 22 
41 25 46 29 49 07 20 13 
04 21 28 16 36 48 10 40 
32 12 24 06 45 35 51 03 
19 39 15 —! 












e. Now let us apply these techniques to the solution of an unknown example. It is assumed that we 
have recovered a C-—+P sequence from the anagramming of several messages of identical length enciph- 
ered by the same pair of double transposition keys. The C-—P sequence is shown below, as is the P—C 
sequence together with its delta: 


Term No.: 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 
CP: 14 35 40 23 02 07 37 63 01 70 47 57 52 19 30 06 13 22 46 51 


Term No.: 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 
C—P: 36 21 44 56 34 69 62 05 45 18 12 55 68 50 11 10 33 29 435 66 


Term No.: 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 
CP: 25 54 61 17 32 42 67 16 49 28 04 09 39 15 31 65 60 27 08 41 


Term No.: 61 62 635 64 65 66 67 68 69 70 
CP: 59 58 03 24 48 53 20 26 38 64 


Kk KOK OK 


Term No.: O1 02 03 04 05 06 O07 08 09 10 11 12 13 14 15 16 17 18 19 20 
P—C: 09 05 63 51 28 16 06 59 52 36 35 31 17 O1 54 48 44 30 14 67 


A: 40 58-12-23 12-10 5B -26 - K-1 — HK-KA 16-4 


Term No.: 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 
PC: 22 18 04 64 41 68 58 50 38 15 55 45 37 25 02 21 O7 69 53 03 


A: 4 -14 © -23 2 -10 -8 -12 -23 40 -10 -8 -12 -23 19 -14 62 -16 -50 57 


Term No.: 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 
P—C: 60 46 39 23 29 19 11 65 49 34 20 13 66 42 32 24 12 62 61 57 


A: 14 -7 -16 6 -10 -8 S54 -16 -15 -14 -7 53 -24 -10 -8 -12 50 -1 -4 -14 


Term No.: 61 62 63 64 65 66 67 68 69 70 
PC: 43 27 08 70 56 40 47 33 26 10 


A: -16 -19 62 -14 -16 7 -lt -7 -16 
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jf. From the differences of portions of the PC sequence corresponding to the repetitions in the delta 
stream, 


Term nos. 16-20: 48 44 30 14 67 Term nos. 26-30: 68 58 50 38 15 
Term nos. 11-15: 35 31 17 Q1 54 Term nos. 31-35: 55 45 37 25 02 
13 13 13:13:13 13 13 13 13 «13 


the width of the T1 matrix is established as 13, so we inscribe the C—>P sequence horizontally into a 
matrix of 13 columns: 








}14 35 40 23 02 O7 37 63 01 70 47 57 52 
19 30 06 13 22 46 51 36 21 44 56 34 69 
62 05 45 18 12 55 68 50 11 10 33 29 43 
66 25 54 61 17 32 42 67 16 49 28 04 09 
39 15 31 65 60 27 08 41 59 58 03 24 48 
53 20 26 38 64| 





The column containing 01 is written horizontally, with the column containing 02 directly beneath it so 
that the 02 is under the 01: 

01 21 11 16 59| 

02 22 12 17 60 64| 


We quickly add the columns containing 03, 04, and 05, properly juxtaposed: 


[Ol 21 11 16 59| 
|02 22 12 17 60 64| 
|47 56 33 28 03| 
|57 34 29 04 24| 
|35 30 05 25 15 20| 


At this point the column containing 06 seems to give conflicts, as does the column containing 07, so we 
add the columns containing 13 and 14 to go under our 12: 


|01 21 11 16 59| 
|02 22 12 17 60 64| 
|47 56 33 28 03|23 13 18 61 65 38| 
|57 34 29 04 24/14 19 62 66 39 53] 
[35 30 05 25 15 20| 


From here on it proceeds rapidly, and we arrive at the following diagram and the outline of the T2 
matrix: 


'40 06 45 54 31 26/01 21 11 16 59/63 36 50 67/41 
63 36 50 67/41|07 46 55 32 27/02 22 12 17 60 64/37 51 68/42 08 
37 51 68/42 08/47 56 33 28 03|23 13 18 61 65 38/52 69:43 09 48 
52 69/43 09 48|57 34 29 04 24/14 19 62 66 39 53/70/44 10 49 58 


70} :44 10 49 58/35 30 05 25 15 20; 


As before, the T2 key is derived by numbering the column headed by 01 as 1, the column headed by 06 
as 2, and so forth to its complete recovery. The T1 key is obtained from our previous diagram of the CP 
sequence inscribed into a matrix of 13 columns by following the breaks shown in the T2 matrix, above; 
thus the column 40 06 45 54 31 26 is given key number 1, the column 01 21 11 16 59 is given key 
number 2, and so on for the complete recovery of the T1 key."* 


14The Tl and T2 keys are derived from literal keys. See in this connection subpar. 62a. 


—GECRET- 252 








13 1 8 6 4 6 3 2 12 7 id 9 


14 35 40 23 02 O07 37 63 Ol 70 47 57 52! 
19 30 06 13 22 46 51 36 21 44 56 34 69 
62 05 45 18 12 55 68 50 11 10 33 29 43 
66 25 54 61 17 32 42 67 16 49 28 04 09 -18 USC 798 
39 15 31 65 60 27 08 41 59 58 03 24 48 -50 USC 3024(i) 
86-36 








g. There are several other methods for recovering double transposition keys from the C—>P sequence, ~*- 
but the one just shown was deemed best from the standpoint of illustrative key analysis. : 
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62, Concluding remarks.—a. In cryptographic practice 26-letter mixed sequences are often based 
upon key words. The recovery of these key words has been treated in par. 51 (on pp. 86-90) of Military 
Cryptanalytics, Part I. Likewise, numerical keys, especially those in transposition systems, are often 
based on underlying literal kéys. The recovery of these underlying literal keys from the numerical keys 
has been treated on pp. 427-429 of Military Cryptanalyties, Part II. 

b. A few final remarks on key analysis might be of assistance. When key is taken from the four-digit 
numbers in a telephone directory there is precious little to give it away, except for the observation that 
the number 0000 is never expected to appear; if it 7s encountered, the premise of a telephone directory as 
the source of the key is refuted. Furthermore, although there might be no discernible limitations in the 
directory of a large city, nevertheless cases have been encountered wherein, for instance, no telephone 
numbers began with the dinomes 07, 08, or 09, permitting easy identification of the particular directory. 
Psychological random, hand produced key, will have characteristics which can be identified as such; type- 
writer random key has similar attributes, including a very infrequent digit ‘‘1”’ when this digit is not on the 
number row but must be typed as a lower-case “‘L’’. Document analysis 7! enters into the picture when 
key has been captured or surreptitiously photographed: in a simple case, the inadvertent occurrence of an 
upside-down digit in the key proves manufacture by single-digit slugs, whereas an entire group upside- 
down proves that group-slugs are involved in the production. The manufacture of key by punched-card 
methods may be indicated when the particular type-styles are identified with commercial electric account- 
ing machines. The particular source or origin of the key might be indicated by the type of paper used, the 
chemical composition of the ink, or even the manner of stapling or binding. These are aspects of key 
analysis that should not be overlooked. The field, then, is pretty well all-embracing, and requires ver- 
satility of outlook and breadth of experience to achieve a significant margin of success. 


21 In this connection, the following works may be of more than passing interest: 
Wilson R. Harrison, Suspect Documents: Their Scientific Eramination, New York, 1958. 
Arthur J. Quirk, Forged, Anonymous, and Suspect Documents, London, 1930. 

Albert S. Osborn, Questioned Documents, New York, 1929. 
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63. General.—In Military Cryptanalytics, Part I and Part IT we were introduced to Baudot systems 
and their encipherment.! The international Baudot code is given here below for ready reference: 








UPPER [WEATHER SYMBOLS z 3 7 | Hoe 
CASE | COMMUNICATIONS ses a He a 17 | ae 3 
| ower case | CASE ele Ja fice jane le ee ao vlw wix 


—. nL 


aia eel Prt ie 
Figure 121 





LTR. SHIFT 
|@|Fis. SHIFT 
























In Fig. 122¢ is given the Baudot combination table containing sums according to the rule that like im- 
pulses produce a ‘‘+’’, unlike a ““—’’; in Fig. 1226 is the complementary table of Baudot sums combined 
according to the rule that unlike impulses produce a ‘‘+”’, like impulses a ‘‘—’’. In most cases it is im- 
material which rule of combination is assumed; but once a convention is sstbplishaa: it must be con- 
tinued in the particular problem under study. In this discussion we shall assume the convention that, 
unless otherwise specified, like impulses produce a ‘‘+”’, unlike a ‘‘—’’. In the Baudot combination tables, 
the character representing the carriage return is symbolized by the digit ‘3’’, the line feed by ‘‘4”, the 
figure shift by ‘'5”, the blank by ‘‘7”, the letter shift by ‘8’, and the space by ‘‘9”’. 

64. Teleprinter key generation methods.*—a. One of the simplest ideas for the electromechanical 
generation of teleprinter key is the employment of 5 cam wheels or pin wheels, one for each “level” 
of Baudot key. As an elementary example, suppose a machine had five wheels in its key-generator 
component of lengths 11, 9, 8, 7, and 5, with pin (or notch) configurations as shown in Fig. 123 (‘‘x” 
denotes an active pin, ‘“‘o o an inactive pin). 


11t might be well at this point to review the material covered in par. 56 (pp. 99-101 of Military Cryptanalytics, 


Part I, and in par. 97 (pp. 294-302) of Military Cryptanalytics, Part II, 
2 See also par. 14 on pp. 471-474 of Appendix 6 (“Cryptographic Supplement’), Military Cryptanalytics, Part II. 
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OY DUA MM EIT AD OdRAN Pols NMHO mE Or Noo 
HMA AMO DOARHP>OUUITHAMDYUNENOOR|Isa re Od H 
YNHAAINYHYBZOADUTOHD> OY ROMAN >a mb ereEnmow 
AMNDOHEB NAU> ak xKMOPHMN DelAe+zoOnim FE wN OD 
wGA2ZO STOMA SIDDAMEMYOHNIIDHMOR OK OOmDAN 
POF MSH D ANAM EANYNIN MOORE dOKRNMZ>oOHMe mM 
HMM OWS ADH OL MM OMINOMAalrRErROHWINDNME Zo 
SHDHOWOFOMOMINAYOHMAMNOlMr- AR aH MIA SnN> WY 
O>AOHIm EAI ZIM > ID 5 COIN Yor mmouaimMnenroc 
FAPAN SM aon Wlo + 2 = MH HelVOKE YN MIO I, e MT 
HE SOMONKOMOMAxXIE UME IY NN MOH TED >No 
AF OAD eS SZ HMNORHUS eM oe MOLE DM OOWIt ON we moO 
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jx oxxoxoxo}xoxxo0xoxo} 
Figure 124.—Machine ‘‘A” 
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Wheel A: 

Wheel B: 

Wheel C: 

Wheel D: 

Wheel E: 

10 

} 
joxxoxoo 
oxoloxox 


xoxxO XOXO 
KXoxOoOO XOX 


oxxoxoo 
oxoxo}ox 





SMOOAMKRUMHAHNNM HSB AZOMOMNAHD SF EHMHNMYNLE WOOD 


A 
B 
Cc: 
D 
E 


Key: 
* The braces in the diagram mark the cyclic repetitions of the five wheels. 


step at each operation, the following would be the generation of the first 35 elements of key: * 


If these wheels are aligned at their initial positions as shown in Fig. 123 
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Since the wheel sizes are relatively prime and each wheel moves one step at each operation, the length 
of the total key is 11X9X8X7X5=27,720. Of the total of 40 pins on the five wheels, 20 are in the active 
position; nevertheless, the generated key is not flat, because in the A and B wheels there is a slight bias 
(6/11 and 5/9, respectively) in favor of a ‘‘+”’, while in the D and E wheels there is a slightly stronger 
bias (4/7 and 3/5) in favor of a ‘‘—’’. Thus the highest probability, that of a key of A (=xx000), is 
OrCO CE KES seas TS .0519, as compared with the random expectancy of 1/32 or 0.03125; this same probability 
will also hold for a key of U (=xxxoo), since the probability of either a mark or a space in the third 
level is 0.5. On the other hand, the lowest probability is that of a key of M (=o0o0xxx) or 0(=o000xx), 
5X4X4X3X2_ a 3. BOER 
“97,720 =0.0173. The gamma (vy) I.C. of this key is 277207 
key is anything but flat, as has already been surmised.’ In its Baudot character form, UBCLDIZUXR 

., nothing is discernible in the foregoing key; but if the component mark and space impulses are 
written out in the five levels as in Fig. 124, the cyclic repetitions may clearly be seen. 


which is =1.083, showing that the 


b. In order to increase the cryptosecurity of machine “A’’, the wheels might be used in combination 
to produce key for the five Baudot levels. In Fig. 125a, below, are the wheel streams of the ‘‘A’’ machine 
set at the same initial position and advancing one step after each operation. In Fig. 125) are the 
key streams for the five levels produced by adding wheels A and B together for the key of level 1, adding 
B and C for the key of level 2, C and D for level 3, D and E for level 4, and E and A for level 5. In 
this stretch of key, no cyclic repetitions are observable in the five levels: the first level has a period of 
11X9=99; the second, 72; the third, 56; the fourth, 35; and the fifth, 55. The total cycle is, of course, 
27,720, since the motion of the wheels in this machine is the same as that of the ‘‘A” machine in Fig. 124. 


5 10 15 20 25 30 35 
A: xxo0o0xoxxxoo}xxooxoxxxoo}xx00xo0xxxo0o}xx 
B: xoxxoxoxo}xoxxoxoxo}xoxxoxoxo}xoxxo0xoxX 
C: xoxooxoxsxoxooxox}xoxooxox}xoxo0o0xox}xox 
D: ox xo0xooloxx0xo0o0}oxx0xo0o0}oxx0xo0o0}0xx0x0o 0} 
E: oxox o}o xo x o}o xo x of0 x0 x of0 x o x of0 xX 0 x of0 x 0 x o} 

Figure 125¢ 
5 10 15 20 25 30 35 

AHB: x000000xX00xXXxXxX0000XK0000XX0000XXxX00X 

BiC: xxxoxxxx00000000XxXxxXxxOXxX¥x0000xXx00xxXxX 

C+D: oo xx00xX0x000xKOXXXXXXX00X000xXxx00xxO 

DHE: xx000x0xxOoxxXxO0xXOXXXXX0O00XxXK00xX000000x 

EtA: o Xxo0oOxXxxXOxXXXXOO0X000KXOXO0O0XXXXXX000xXxXO0 

Key: JGPO9O4GPJMTBBFEMSOCC8BCM448BTTMPUEEPPJ. 


Figure 125b.—Machine “B”’ 


e. Since the wheels as combined in the ‘‘B”’ machine produce levels of periods 99, 72, 56, 35, and 
55, it might be desirable to extend the periods where possible. This may be done by the simple expedient 
of combining the longest wheel, A, with the other four wheels for four of the levels, and combining 
wheel B with C for the fifth level. This produces the following key: 





5 10 5 20 25 30 35 
AtB: x0O00000xXx00xXxXx¥x0000x0000XKKX0000XKxxX00X 
Atl: xooxo000xxx0000xXx00xX0xX00X0xXXxXOX0000X 
AWD: OXOXXxXOO0xXOXKXXOXxXxXO00xXOXxXxxXxX00xX0xXxxX000 
AVE: OXXKOOXXOXXKXXxX00xX000xX0X00XXXKXxXxX000xX0O 
BHC: XX xXOXXXxXOOO00000O0XXXxXOXXXO0000XXOOXXX 
Key: WMOITHMOWCRFFESCITTS8TCHHSFRRCOQSSOOW 


Figure 126.— Machine ‘‘C” 


* Since we are concerned with the universe or total population of this key, the correct statistic to be computed is the 
gamma I.C., not the delta 1.C., which is that for a sampling of a universe. 
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. Now the periods of the five levels are 99, 88, '7'7, 55, and 72—an improvement in only two of the 
cycle lengths. A better idea might have been to combine three wheels for each level key, as in the follow- 
. ing diagram wherein, for example, the first key level is produced by adding together the A, B, and C 


wheels: 


ABC: 
BCD: 
CDE: 
DEA: 
EAB: 
Key: 


"N10 4 O XM 


“Io x O MM 


Qi4 «OK O 


PIO MM MM 


OK OK MM 
crix Ox 0 0 


no Oo « oO KM 


"IO mM MO MM 


Zzlo x MOO 


MIM MMO KS 
cloo x M 


15 20 
ooxxooxxxxox 
oxxxoxoxoxox 
oo000x0x000x 
xxxoooxxxoxo 
xOxXxXxXoOXXxX XOX 
ORSWTIBSBH3S3Q 


Figure 127,—Machine ‘‘D’’ 
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nlo ooo 
m/x 0 O x OM 
nNlo 0 ® O 
ploooxn xs 
wlo o X00 
olyK x Oo * mM 
QIK * Ox O 
mjo Oo % OM 


Wlo x x OMB 


The periods of the five levels are now 792 (=11X9X8), 504, 280, 385, and 495, a considerable improve- 
ment in the lengths of the individual cycles. 
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65. Analysis of combination streams.—a. Let us assume, that we have 


ae the 35 elements of‘key of the ‘‘R” machine shown in Fig. 1250. 
ey level 1 1s as follows: . : 





a « 

. 5 10 15 2, 5° 30 a5 

IXO00000XO0OXXXX000OXO000XXD000XXX00OX 
- a 


No cyclic phertomena are observable in this stream of binary impulses (also called binary digits or “‘bits’’), 
and the conjecture is made that, unless a single wheel df size 34 or larger is involved, the stream might 
have been produced in a cipher teleprinter by the interaction of*two regularly stepping wheels of differ- 
ent sizes.'!° Consequently, the stream of bits is written,on various trial widths, commencing with a width 
of 5 (see Fig. 136a, below). Now in each one of the width write-outs we will add the first row of bits to 


« 

12345 123456 Losaser 12345678 123456789 
xoooo xoooo0o0 xooo0o00 9 xo0o00000%x xo000000x0 
ooxwo oxooxx X0O0X X Xx ooxxxxoo oxxxxo00o00 
xxxxo xxoooo ©oo000x0O “oo0x0000Kx xoo000xXxX00 
ooo0xo xo0000x ooxxo0dgo+ x0000xxxX ooxxxoox 
oooxx xo0o0oox oxxxo0ox"* oOoOX 
0000 x xxoox " 4 
xxow x paae 

; Fiqure 1364 


. 
a@ 


10 Tf we had-recovered enough key, we could havenbdticed that the KL1 stream repeated after 99 positions. 
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the second, the second row to the third, and so on. Since in binary arithmetic addition is identical with 
subtraction, this produces what amounts to a delta or difference stream at the particular interval, e.g., 
a “delta 9” (abbreviated A,). At the cerrect assumption of the length of one of the wheels, the 
length of the other wheel will be disclosed by a repetition in the delta stream." In Fig. 1366 we show the 


123 4 5 123 4 & 6 123 45 67 123 45 67 8 12345678 9 
oxo xx ooxxood xxxoo000 oxogog ogo xo o0oaca0OOKXOX 
ooxox ox x kooO ox xoxoaod xxxoo0oo0oxoO oofo0000xx 
ooOoOxxX xox x xo XxXo0o0o0oxkK xXx oxox xoox o x0 o0fo 000 
xxXxXXO xxXXxXXX xXxOoxXXxXKXKO oxo 

xxXxXOxX xOxXxXO 

ooxxx 


Figure 1366 


delta streams as derived from the width write-outs of Fig. 136a; in the width write-out of 9, an 11-long 
delta repetition may be seen, thus proving that the sizes of the wheels involved are 9 and 11. 

b. Knowing that the lengths of the wheels are 9 and 11, we can now recover the wheel patterns. We 
write the KL1 key stream on either one of the two widths, say 9. The first key element, ‘‘x’’, is assumed 
to have arisen from a combination of an “x” with an ‘‘x”’ on the two wheels; on this assumption, an “x” 
is recorded in the A-wheel portion of our diagram of the key write-out, and also at the beginning of every 
cyclic repetition of the other wheel. This is shown in Fig. 137a, below: 


1 23 4 5 6 7 8 @ 123 4 5 6 7 8 9 123 4 6 6 7 8 9 
A: x x x oO oO XxOoxxX0OxXOxXO 
KL1: xoo00000x0 xXxOO0O0000x0 xo0oO0O0000x0 
B: x x xxooxoxxx 
oxxxxoo0o0o0 oxxxxoo0o0o0o oxxxxoo0o0o0 
}x }x oo}x x00x0x 
x0000xxO00 xooooxxoo xoo0o0 xXxx00 
}x }x xxoo}xxo0ox 
ooxxxoox ooxxxoox ooxxxoox 
}x }x oxxxoo}xx 

Fiagure 137a Figure 137b Fieure 137c 


The placement of the ‘‘x”’ impulses at the beginnings of the B-wheel streams enables us to derive three 
more values for the A wheel, as shown in Fig. 1376; the complete patterns of the two wheels are then 
quickly recovered, as shown in Fig. 137c. These are either the true patterns, or their inverse, since our 
assumption in Fig. 137@ of an ‘‘x” on the two wheels to make the first ‘‘x” in the key stream was arbi- 
trary—there is no way of proving this point. 

c. The solution of the remaining wheels of the machine continues in similar fashion with the pro- 
cedure just illustrated ; or, if the cryptanalyst has a hunch that the 9- or 11-wheel has been used for another 
key level, perhaps level 2, he might try writing this level out under the two wheel patterns just recovered, 


as shown below: 
11 


a 


7 8 9 
Oo XO 
KL2: KL2: x x Oo 


~M MH OO M MIKE 
xx *HM OO MM MIM to 
a O KF O HM MIO w& 
~O # O # O10 
00 OO MM IK & 
~*0O OF OR [O @ 
pe 
OOM PP 
oOo KH OOK 
x™OoO XO xX Olog 
“ax OM M O10 
oO KX # OO BM iH & 
om OF FO OO RIO 8% 
xe OO OO MM) & 
o-*M OO OO 


° 
SS 
* 
°o 
x 


Figure 138a Fiaure 1386 


1 See also in this connection subpar. 977 on p. 301 of Military Cryptanalytics, Part II, with reference to the solution of 
a two-tape Baudot system. 
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It may be seen in Fig. 138) that upon “stripping off” the 9-wheel from the KL2 stream, we are left 
with a residue that cycles at 8, which is the length of the other wheel in the KL2 stream. We could now 
strip off this 8-wheel from the remaining key levels, achieving success with KL3 and recovering the 
7-wheel; the 7-wheel stripped off from K1L4 yields the 5-wheel; and finally the 5-wheel stripped off 
from KL5 produces the 11-wheel initially recovered. 

d. If the cryptanalyst had the 35 elements of recovered key of the ‘“B” machine and knew the 
sizes of the five wheels (11, 9, 8, 7, and 5) but not their patterns or combinations for the particular 
levels, there is another easier procedure for their recovery. With five wheel sizes to choose from, there 
are ten possible combinations of five things taken two at a time * to produce the key for a particular 
level: 11-9, 11-8, 11-7, 11-5, 9-8, 9~7, 9-5, 8-7, 8-5, and 7-5. In analyzing key level 1, we will make 
the assumption that is it composed of an 11-wheel and one of the other sizes. We will begin by construct- 
ing a rectangle of, say, 118, and inscribing KL1 in a cyclic diagonal pattern from the upper left-hand 
corner of the rectangle. This is shown in Fig. 139a, below, wherein the first diagonal ends in col. 8 and 
continues in the first row, col. 9 briefly, and then in the fourth row, col. 1: 





1234 567 8 91011 123456789011 123465678910 
x x 0 ° oO x x ° °o oO xxxXX Ox Oxo 
x|x x oO" o oO x|x x ° a) x Xx ° o °O 
oo). lO ° ° oO ° 

xo 0 x x 
x °o 800 ° 

x o 8 (0° ° 

x o x ° 
° ° o x 

x ° x «x 

Figure 139a Fiaure 1396 Fiaurk 139¢ 


Since the first element of the KL1 stream is an “‘x’’, we will assume it is the result of a combination of 
an ‘x’ with an “‘x’’; accordingly, we will place an ‘‘x’’ over col. 1 and an ‘‘x’’ to the left of the first row. 
Now that we have an ‘‘x”’ at the side of the first row (i.e., an element of our supposed 8-wheel), we can 
place four more values heading the columns (i.e., in our assumed 11-wheel); all this is shown in Fig. 
139a. The “x” over col. 1 enables us to place three more values in our 8-wheel: this is shown in Fig. 1390. 
These latter placements enable us to add some more values in the columns (see Fig. 139c), until we notice 
a conflict (shown by the ringed value). This is proof that KL1 is not composed of an 11-wheel and an 
8-wheel. 


! 
12 The formula for the number of combinations. of n things taken r at a time is C= Ha cpr in the case just men- 


; — 5!  5K4XK38xK2xK1 5x4 ake : sia 
tioned, C= a6 —D 1 @x1)@xX2X1) 9x1 1% The number of combinations of 5 things taken 3 at a time is also 
10, since C= SI 5 K4X3BXK2XK1 _ 5X4 


315-3)!" (8X2X1)(2X1) 2x1 
18 A quicker process of finding conflicts is to compare the top row (above the matrix) with each successive fragmentary 
row within the matrix: every ‘‘x’”’ in the top row should go unambiguously to the same symbol (either ‘“‘x”’ or ‘‘o’’) ina 
particular row. In Fig. 139c a conflict is seen when an ‘‘x’’ in the top row goes to both ‘x’? and “‘o” in the fourth row 


within the matrix. 
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e. In Figs. 140@ and 6, below, are shown two more incorrect assumptions (11-5 and 11-7), with 
conflicts indicated by the ringed values—one conflict is all it takes. (Note that we do not require all 
35 elements of the recovered key level: it will suffice for our purposes to use just enough of the key 
stream to insure two or three values in each of the columns.) Finally, we have in Fig. 140c, below, the 
correct assumption of wheel sizes (11-9); there are no conflicts, and the two wheel patterns have been 
completely recovered : 





OX OX OR HO HM 


Figure 140a Ficure 1406 Fiaure 140c 


f. As mentioned before, the wheels recovered will either be the true patterns, or their inverse: 
solution can be gotten either way. One thing that is proved, however, is the particular rule of combina- 
tion, whether it is Vernam or mod 2. In subpars. b-e we assumed the Vernam rule, and it worked. But 
suppose we had used the mod 2 rule? As an example, let us take the situation of Fig. 137a, but with the 
incorrect rule. In Fig. 141a we assume that the first element of KL1, an ‘‘x”, is the result of the combi- 
nation of an ‘‘x” with an ‘‘o’”’; in Fig. 1416 is the completed diagram with the patterns of the two wheels: 





123 4 6 6 7 8 9 12 3 4 56 6 7 8 8 
A: x A: xoxxoxoxo 
KL1: xo00000xX0 KL1: xooo0000x0 
B: o B: ooxxoxooodo 

oxxxxoo0o0o0o oxxxxooo0o0o 

lo x x}oox xoxo 
x0o000xx00 x0000xx00 
Jo ooxxjooxxo 
ooxxxoox ooxxxoox 
Jo xo000xxjoo 

Fiaurer 14la FiGureE 1416 


It can be seen in Fig. 1416 that, whereas one of the wheels (the 9-wheel) has the true pattern, the other 
has the inverse pattern, so it would be patently impossible to reconstruct the machine with an incorrect 
and incompatible “recovery”. But the proof of Vernam addition has been evidenced from the start, 
had we been more observant—and had we known the earmarks—from the sample of 35 elements of the 
““B” machine key in Fig. 1256 that we were analyzing: all the Baudot characters contain 1, 3, or 5 mark 
impulses, never 0, 2, or 4. Thus there is a maximum of only 16 different characters that can occur (there 
were actually only 13 in the sample). (Had mod-2 addition been involved, all the Baudot key characters 
would have been composed of 0, 2, or 4 marks.) The reason for this is not difficult to ascertain: because 
each wheel in our machine is present an even number of times during the formation of a Baudot char- 
acter, it follows that the binary sum of the contribution of each wheel is an ‘‘x”’ (in the case of Vernam 
addition) or an “‘o”’ (in the case of mod-2 addition).'* As an example, the first key character in Fig. 125) 





4 This observation holds true only if the wheels have single key-reading stations; if there are two or more reading 
stations it cannot be guaranteed (except in certain special cases) that the binary sum of the contribution of each wheel 
will be an ‘x’. 
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-is a J (=xxoxo); this is derived from the following wheel combinations and their contributions: 

A+B, B+C, C+D, D+E, E+A_ Since in such a set of ten binary impulses there will always be an 
XX XX xO 00 8=6—ox 

even number of marks or spaces, the binary sum of these ten will always be a mark—therefore the 

final Baudot character must contain 1, 3, or 5 mark impulses. (Note that in Fig. 126, since each wheel 

is not present an even number of times, there is no such mark limitation; there is, however, another 

limitation which will be discussed later.) 

g. Let us return to the “B’’ machine key as given in Fig. 1255 for some further theoretical observa- 
tions. Since KL1 is composed of the A wheel (length 11) and the B wheel (length 9), this level will cycle 
at 11X9=99. KL2, composed of the B and C wheels, will cycle at 9X8=72. If these two key levels are 
combined, as shown in the illustration below, the resultant stream will cycle at 88, the product of 
the A and C wheels, since the effect of the B wheel present in both key levels has been cancelled in the 


5 10 15 20 25 30 35 
KL1: xoooo000x0oxxxx0000xo000xXx0000XXxXO00X 
KL2: xxxoxxxxo00000000xXxXxxxOxxx0000xxO00xK xx 
Sum: xooxo00o0xxxooo0oxx00xo0oxo0o0oxoxxxox0000x 


addition process. This is really not of much help in analysis of this case, since it would be just as easy to 
attack KL2 directly and partition this key level into its two component 9- and 8-wheels; nevertheless, it 
demonstrates the cancellation of a wheel when it is present an even number of times in a summation 
stream. 

(1) Now let us consider the 35 elements of key of the ‘“D” machine given in Fig. 127, in which 
each key level is derived from a combination of three wheels. KLL1 comes from wheels A, B, and C, and 
the product of these wheel sizes, 11X98, may be written as 11(9X8) or 9(11X8) or 8(11X9); 
therefore if KL1 were written on a width of 11 or 9 or 8, upon taking vertical differences on those widths 
(ef. subpar. a) we would get cyclic repetitions in the delta streams of lengths 72, 88, and 99, respectively 
(it may be seen that vertical differences on a width of 11 would take less material for solution). But let 
us combine KLi and KL2 of Fig. 127, as shown below: 


5 10 15 20 25 30 35 
KL1: xxoxxoxxoxxooxxooxxxxox¥xxOxxxoxoxx 
KL2: x x ° x 0 x xoxo xox x ° xo x o 


Sum; oXoxXxXx0O0xXO0XXOXXxXOOXOXXXXxX00X0XXx000 


If extended far enough, the summation stream would be found to cycle at 77, since in the course of 
combining A+B+C and B+C+D the effect of the B and C wheels would be cancelled, leaving only 
the combination of the A and D wheels, with the resultant cycle of 77. But there is a remarkably easy 
procedure in the solution of the small amount of key of Fig. 127, as will now be shown. 

(2) On the hypothesis that each level of the key of Fig. 127 is composed of three wheels in combi- 
nation, we will derive summation streams by taking the 10 possible combinations of three levels, in 
addition to the summation of all five levels taken together. In Fig. 142a, below, we have the key streams 
for the five levels, while in Fig. 1426 we have the 11 possible odd combinations of these levels, in the 
first row of which, for example, is the summation of KL1, KL2, and KL3. An astonishing phenomenon 
is now brought to light: in five of the rows of Fig. 1425 we can clearly see the cyclic repetitions of the 
five wheels of our machine! 


5 10 15 20 25 30 35 

KLI: xxoxxoxxoxxoaooxxooxxxxoxxxxoxxxoxoxx 

KL2: oxxxxoo0000xoxxxoxoxoxoxxxoxxoxoxxoo 

KLS: xooxxxxxxxxoo0o000xo0oxo00o0oxxxxooxoxooxx 

KL4: xxxxoooxxxoxxxo0oo0ooxxxoxoxoxo00o00n00g00xxox 

KL5: ooxoxxoooxoxoxxxoxxxxoxxoxoxo0oo0oxxood 
Fiaure 142a 
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Levels 5 10 15 
123: ooxxxxooxoxoxoo000d0 
124: oxoxojloxoxojoxoxojox 
125: xoooxxxxoooxxxxxxX 
134: xoxxoxoxo}xoxxoxox 
135: oxxoxoo}oxxo0xo0o0joxx 
145: oooo0oo0oxxoxxxoxxoxo 
234: oooxoxxo0000xoo0xood 
235: xx00xoxxxoo}xxo0o0xo 
245: xoxooxox}xoxooxox}x 
345: oxoo000xo00xxoxoxxx 
12345: xxxoo000x00x000xxoO 
FIGurRE 
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xxox00 
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xOOXXX 
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xoxo o}o 
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XX XOXX 
xxXOXxXO 
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Now let us examine what brought this about, since we know the answer from Fig. 127. The sum of levels 
124 yielded the 5-wheel, so we shall set down the arithmetic involved: 


KLI is composed of wheels A, B, C 


KL2 is composed of wheels B, C, D 
D 


K14 is composed of wheels A, E 


The sum, by cancellation: 


E 


It can be seen that by summing key levels 1, 2, and 4, four of the wheels are cancelled, leaving the E 
wheel alone in the residue. Similarly, the other four wheels are exposed uniquely in the residues of the 


following combinations of key levels: 


KL1: A,B,C KL1: A,B,C 
KL3: C,D,E KL3: C,D,E 
KL4: A, DLE KL5: A,B, E 
Sun: B Sun: D 


KL2: 
KL3: 
KL5: 
Sum: 


B,C,D KL2: 
C,D,E KLA: 
A,B, E KL5: 
A Sum: 


If we study the following diagram of all the combinations of five wheels taken three at a time, plus the 


one combination of all five wheels taken together, 


1. AB 
2. AB 
3. AB 
4. A- 
5. A- 
6. A- 
7. -—B 
8. -B 
9. -—B 
10. -=- 
ll. AB 


a?) 
v0! 
ico | 


aaAatraAaaAaIraAAa 
oOvuUvU IT UU I OI 
PHARMA! Ae 


it may be seen that if we add any two of these lines together, we shall have an even number of wheels 
in the answer; and if we add any three lines together, we shall have an odd number of wheels in the 
answer. The reason for the inclusion of line 11 (summing all five wheels together) may be shown if 
we had to contend with the following combinations composing the level key streams, for example: 


ABC - 
AB-D 


Key levels: 


ak AN 


| > > 
w I 
Q 

I 


ow 
Qt 
ol 


E 


PI 


18 This answer is really a function of the number of reading stations involved, not the number of wheels, but in this 


case the two are synonymous. 
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Wheel A would be exposed by summing key levels 1, 2, and 4; wheel B, by summing 1, 3, and 5; wheel 
D, by 3, 4, and 5; wheel E, by 2, 4, and 5; but in order to expose wheel C, we would have to sum all 
five levels taken together. 

(3) Now to get back to our analysis, without the benefit of foreknowledge. We have found out 
that the key levels of Fig. 142a are composed of combinations of three wheels of lengths 11, 9, 8, 7, 
and 5, but we don’t know specifically which three wheels go to make up a particular key level. Let us 
consider the combination of levels 1, 3, and 4 which produced a unique wheel of length 9 in the answer. 
We know, first of all, that an even number of levels will produce a sum composed of an even number 
of wheels in the answer. Now if we make an arbitrary assumption that level 1 consists of wheels ABC, 
level 3 will consist of either (a) wheels ABD, or (b) wheels ADE, since the sum of KL1 and KL3 must 
be an even number of wheels. (The ABC, ABD, and ADE as used here are arbitrary designations assigned 
for solution and are not necessarily related to the designations originally assigned to machine “D”’,) 

(4) Let us assume that KL3 consists of wheels ABD. If so, then the addition of these two levels 
will produce wheels CD: 


5 10 15 20 25 30 
KLL: xxoxxoxxooxxooxxxxoxxxxox x 
° 
° 


x xo x x 
KLS3: xooxxxxxxxxo0O0000xO0x000XxXxXx00xX ° 
ox x ° 


Sum: x xxXOXxoxxXxXxXOGCOXKOOXKOOQOXKXxXXKXKXO 


Oo} oOo 
x lo oO 
x be 
xin eR 


Ficure 143a 


Since the addition of level 4 produces a unique wheel, this level must perforce consist of wheels ACD, 
BCD, or CDE. Furthermore, since the addition of level 5 to the combination of KL1 and KL3 results 
in a different unique wheel (of length 7), this means that level 5 must have been produced by one of the 
three possibilities not used for level 4. KL4 contains the 9-wheel and an unknown pair, while KL5 con- 
tains the 7-wheel and the same unknown pair. Since the recovered wheels are of lengths 9 and 7, this un- 
known pair of wheels must be one of the remaining three combinations 11-8, 11-5, or 8-5. If we now 
strip the 9-wheel from KL4, 


5 10 15 20 25 30 35 
KL4: xxx x000xxXOoxxx000Xxx0xo0x0x00000XxO0xX 
OW: xoxxoxoxo}xoxxoxoxo}xoxxoxoxoj}xoxxo0xox 
Sum: xox XXOXXOXXXXOOXOOXOOXXXXXXOXOOOXKXKX 


Figure 1486 


only one trial should be necessary to determine the composition of the unknown pair—because if we 
difference out the 11-wheel, the residue must be the 8-wheel or the 5-wheel; if not, then the unknown 
pair must be the 8-5 combination. Accordingly, we difference out the 11-wheel from the summation 
stream above, as follows: 


5 10 15 20 25 30 
Sum: xoxxxoxxoxxxxooxo00xo0o0oxxxxxx0x000X 
llW: xxooxoxxxoo}lxxooxoxxxoo}xxo00xoxxxoo}x 
Res: xo0oo0oOxXXXxXOOOXXXXXKxXOXOXOXXOOXXKXOOXOX 


Ed 
xx «eB 


Figure 148c 


Clearly, the residue is neither the 8-whee] nor the 5-wheel, so it must be the 8-5 combination. But we 
had better make sure; so we shall difference out the 8-wheel, which will yield the 5-wheel in the residue: 
5 10 15 20 25 30 a5 
Sum: xoxxxoxxoxxxxooxo0o0xo0oxxxxxxoxo0o0oxxx 


BW: xo xo0o0xox}xoxooxoxsxoxo0oxox}xoxo00xo0x}xox 
Res: xx xX0000x00X000xXxX0XXxXXXOXXOXXOOXOXOX 


Figure 143d 


The 5-wheel is nowhere to be seen. What is wrong?—the basic assumption in the first sentence of this 
subparagraph is in error: the sum of KL and KL3 must consist of two pairs of wheels, and not one pair 
as we thought; therefore KL3 does not consist of wheels ABD, but rather ADE. 
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(5) Since we now know that KL3 is composed of wheels ADE (with respect to the arbitrary assump- 
tion of wheels ABC for KL1), this means that the sum of KL and KL3 must be four wheels rather 
than two: 

KL1: A, B, C 
KL3: A D,E 
Sum: B, C, D, E 





Furthermore, the addition of KL4 to this sum exposes one of the wheels already in this sum, so KL4 
must consist of three of the wheels in the sum. Likewise, the addition of KL5 to the sum exposes another 
one of the wheels already in the sum, so KL5 must consist of another combination of three wheels in the 
sum. This is shown graphically by the following example, in which the exposed wheels are arbitrarily 
designated as D and E: 





Sum: B, C, D, E Sum: B, C, D, E 
KL4: B,C, D KL5: B, C E 
E D 


This means, then, that if we subtract the D and E wheels from the sum of KL1 and KL3, we shall be 
left with the combination of two other wheels, B and C. The two wheels already exposed are the 9-wheel 
and 7-wheel, so we first add these two together: s 

5 10 15 20 25 30 35 

OW: xoxxoxoxo}xoxxoxoxo}lxoxxoxoxo}xoxxoxox 

TW: oxxoxooloxxoxo0oj}oxx0xo0o0}foxx0xo0 ofoxx0x00} 

Sum: O00 x000xX00XXXOXO00KXXXKO000XKXXXOXXXXXXO 


Figure 1444 


If we now strip off the effect of the 9- and 7-wheels from the sum of KL1 and KL3 (which is a four- 
wheel sum), we will have left the sum of two of the remaining wheels: either 11-8, 11-5, or 8-5. In Fig. 
1446, below, the top row is the sum of KL1 and KL3, the second row is the sum of the 9- and 7-wheels, 

5 10 15 20 25 30 35 

(l): xoxxxoxxoxxxxo0oox00xo0oxxxxxxox0o000 xxx 

(2): oo x0O0OKX0O0XXxXOX00KXXXXO000KXXXOXXXXXXO 

(3): oxxooxxoxxxxoox000xoxooxxxxxxoooxxo 


Figure 1446 


and the third row is the result of the Vernam addition of the first two rows. On the assumption that the 
11-wheel is involved, we will subtract it from the summation line of Fig. 1445, as shown below: 


5 10 15 20 25 30 35 
(3): oxxooxxoxxxxooxo0o0oxoxooxxxxxxoooxxo 


11W: xxooxoxxxoo;xxooxoxxxoo;x x00 xOxxXX0O Ojxx 
Res: oxo xo0joxoxofoxo xojoxoxojoxoxojoxoxojoxoxo 
Figure 144c 


The 5-wheel is disclosed in the residue, so this now tells us that the sum of KL and KL3 consists of the 
11-, 9-, 7-, and 5-wheels. 

(6) The composition of KL4 and KL5 may now be determined exactly from the fact that when 
KL4 is added to the sum of KL1 and KL3 the residue is the 9-wheel, and when KL5 is added to the 
sum of KL1 and KL3 the residue is the 7-wheel. The wheel combinations for KL4 and KL5 must there- 
fore be those in the following diagrams: 


KL1 + KL3: 119-75 KL1 + KL3: 119-75 
KL4: ll --—75 KL5: 11 9 — — 5 
Residue: 9 Residue: 7 


SECRET 282 





~SEORaT. 


' The determination of the composition of the remaining key levels is an equally simple matter. In Fig. 
142) we saw that the combination of levels 2, 4, and 5 produced the 8-wheel uniquely, so in order to 

recover the combination for KL2 all that is required is to set down the wheel combination which when 
added to the sum of K14 and KL5 will give a residue of the 8-wheel: 


Ki4: 11--75 
KL5: 119--5 
KL2: ~987- 
Res: 8 


Having ascertained the composition of KL2, we can now consider the combination of KL2, KL3, and 
KL5 which produces a residue of the 11-wheel alone: 


Ki2: -987- 
KL5: 119--5 
KL3: --875 
Res: 11 


Finally, after the KL3 combination has been recovered, the composition of the remaining level 
(KL1) is obtained from the combination of levels 1, 3, and 5, which produces a residue of the 7-wheel: 


KL38: --875 
KL5: 119--+-5 
Kbil: 1198 -~- 
Res: 7 


The machine is now completely solved. In recapitulation, the key levels of the machine were produced 
by the following combinations of wheels: 


119875 


Key levels: 





h. One more aspect of wheel combination remains to be treated: that of Boolean addition. Let us 
refer to the key of the “E”’ machine given in Fig. 128, wherein KL5 is produced by the Boolean addition 
of the A- and E-wheel streams. If KL5 were extended to 70 positions, we would have the following: 


5 10 15 20 3 30 35 
xxoxxoxxxooxxxoxxxxxoxxxooxoxxxxoxx 
40 45 50 55 60 65 70 


OXXxXxXXOKKXXOXOXKXXXXOKXOKXOXXXOOXXXO 
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In Fig. 145, below, we have written KL5 out on several trial widths, and at the bottom of each column 
we have recorded the product of the entries in the column, i.e., the combination according to the multi- 
plication rule (00, ox, XO = ©); in other words, we record an “x” only if every impulse in the column 
is an ‘“‘x’’, otherwise we record an ‘‘o”’. 


CI OMX HX KHOR OOMROO RUE 
Mie Me MO mM OM Oe Me Hw OM ID 
Om xX OK OCOX OC ORMH KO 
WIM MM MO OM OM OM Oe OM OM 
OIFOOKROCOMKXMHOnROORE 
OPM OOK ORMROMMM RE 
OM HOM MM OM MM KD 
Oly eM MH KOR OO HM Ow 
OCJOX OR MM MOM MO RE 

° On MM MMM HM HMO Me 

° OX xX OM OKKRXMK OG 
OM KOC OK ROK MH 
OJOOxKX MM KRM MRM MD 

OJON MMRKXRM MOO & 

O-_ MRM KH KORO MM 

OK OX KM KH OOM MR KM 

olK ROOK XMM xX OG 

olom x eM XMOOM RNA 

ajo x X¥ KOO MK KY 
OJOoO0 OR KOR OKN 

OK xX OX KX KO Ow 

O|lX eH HOO KM Mm 

Of OM MM MO KM MO 

Ojo XH HM KRM KKH OP 

° ~ OM KM RK OKA 

° MM OK mM MM KO 
“(MMMM OM OM 

ais MMM KY 

ox OX 0 0 XO & 

olo XOX OOK 

x MMMM KR 

° COR OK O@ 

“ MMM MM RS 

x MO OM OM OM 

% “xe M MM RM © 

°o oe OM O05 

° COX OMOE 


Fieure 145 


It may be seen that in the write-outs of the correct widths (5 and 11), the patterns of the wheels are 
manifested; on any incorrect width, the sum of every column will be an ‘‘o’”’, unless the amount of ma- 
terial available for analysis is too limited. 

t. If only one wheel of a two-wheel Boolean summation stream had been recovered, the procedure is 
still simple. Suppose that in the preceding subparagraph we had neglected to try a width of 5, and that 
only the 11-wheel had been uncovered. We would write the cycles of the 11-wheel over the key stream, 
leaving a blank row in the middle for insertion of values from the other component wheel; these values are 
inserted in the unknown wheel stream (‘‘?W’’) only when they are unambiguous on the Boolean assump- 
tion, i.e., when there is at least one ‘“‘o” at a given position in the superimposed 11W and K streams, so 
that oo = o, and ox or xo = x. Thus: 


5 10 15 20 25 30 35 

11W: xxooxoxxxooxxo0oxoxxx0o0oxxo0oxoxxxooxx 
ow: x ° o.0 xo x x ° ° x_O 

K: xxoxxoxxxooxxxoxxxxxoxxxooxoxxxxoOxx 

40 45 50 55 60 65 70 


1lW: ooxoxxxooxxooxoxxxooxxo0oxoxxxooxxo0o 
eW: ox x ox xo ° x0 ox ° 0° xo 
K: oxxxxXxXxXOXXXXOXOXXXXKOXXOXXKOXXXOOXxXxXO 


From the location of the ‘“‘x” and “‘o” entries in the middle row, we are able to eliminate wheel sizes for 
the unknown wheel on the basis of conflicts. For example, sizes 2, 6, and 7 are ruled out because of the 
clash of the ‘x’ bit at position 4 with the ‘‘o” bits at positions 6, 10, and 11. The tabulation of wheel 
sizes eliminated up to 20 is shown below: 


W Positions W Positions W Positions W Positions 


2 46 7 4411 12 10-22 17 421 
3 22-25 8 6-14 13 26-39 18 21-39 
4 22-26 9 17-26 14 3-17 19 14-33 
5 10 15 20 

6 410 ll 3-14 16 3-22 
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The absence of conflicts at an interval of 5 and any of its multiples points to the size of the unknown 
wheel; this is substantiated when we write out the partia] bit stream on a width of 5, the bits in the 
columns being combined by the multiplication rule to disclose the pattern of the wheel: 


12 3 4 5 
ox 
Oo oO 
0 x 0 


° QO 
o x_oO 
oxoxo 


Notice that if we write the partial stream on widths of 10 or 15 the cyclic pattern of oxoxo is still clear 
in the product line, even though in the writeout on a width of 15 it is complete because of lack of 
sufficient material (this latter point must not be forgotten when dealing with limited amounts of data): 





123 4 5 6 7 8 9 10 1 23 4 5 6 7 8 9 10 11 12 13 14 15 
ox ° ° Ox ° 0 0 x Oo 
° x 0 x x Ox 00 ° 
Ox 0 0 O x Oo ox x ox 
x Oo Ox x x 0 ° x Oo Ox 
Ox x oO oO ° 9.9 X_O 
xo ox oxoxoaox x oo oxo 
° 0.9 x_O 
oxoxooxoxo 
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“The diagnostician and his attributes. ----_-..---------------------------------------+- 22-2 e eee eee 73 
«Embarking on the unknown cryptosystem__.-_------_--------------------------------------------------- 74 
« Preliminary actions in attacking the unknown cryptosystem_----...--------------------------------------- 75 
* First step: manipulating the data_.__.____._.-------___------------------------------------------------- 76 
Second step: recognizing the phenomena_-___--.-----_.-------------------------------------------------- 7 
bir inter Tipe Lhe phenomena = ai dn ihe I eel he aes eee ee So ee ee ee 78 
Beira a et oie eRe tran ot ane eS AE sa etna Send 79 
OStMOrMeMsels2. 2 454s) 32 Let ee ee ee a Be ee a eh ee. eee ee 80 


71. General_—a. It never hurts to know what it is we’re talking about, so let us begin with the 

definition of “diagnosis” as given in Webster’s Third New International Dictionary: 
“diagnosis, n. 1. The art or act of identifying a disease from its signs and symptoms; also, the 
decisions reached. 2. A concise technical description of a taxonomic entity giving its distin- 
guishing characters. 3. Investigation or analysis of the cause or nature of a condition, situation, 
or problem: a statement or conclusion about the nature or cause of a phenomenon.” 

From Webster’s New International Dictionary, Second Edition, the following entries under ‘‘diagnosis”’ 

are of interest: 


“diagnosis, n. 1. . . . 2. Determination of a type or condition through case or specimen study. 
3. Conclusion arrived at through critical perception or scrutiny; hence, keen understanding of 
appearances.” 


Finally, let us set down the definition of “diagnosis” as it appears in the NSA Basie Cryptologic Glossary 

(June 1971): 
“diagnosis, n. 1. In cryptanalysis, a systematic examination of encrypted text or key with a 
view to discovering the nature of the cryptosystem that produced it. 2. The result of such 
examination.” 

These definitions should clear the air and set the stage for the discussion which follows. 

b. Let us first quote from a previous text! an extract which is particularly apropos, elaborating 
on the meaning of diagnosis: 


(1) “Except in the case of the more simple types of cryptograms, the step often referred 
to as diagnosis, that is, ascertaining the general system according to which a given cryptogram 
has been produced is usually a difficult, if not the most difficult, step in its solution. The reason 
for this is not hard to find.” 

(2) ‘As will become apparent to the student as he proceeds with his study, in the final analysis, 
the solution of every cryptogram involving a form of substitution depends upon its reduction to 
monoalphabetic terms, if it is not originally in those terms. This is true not only of ordinary sub- 
stitution ciphers, but also of combined substitution-transposition ciphers, and of enciphered 
code. If the cryptogram must be reduced to monoalphabetic terms, the manner of its accom- 
plishment is usually indicated by the cryptogram itself, by external or internal phenomena 
which become apparent to the cryptanalyst as he studies the cryptogram. If this is impossible, 
or too difficult, the cryptanalyst must, by one means or another, discover how to accomplish 
this reduction, by bringing to bear all the special or collateral information he can get from all 
the sources at his command. If both these possibilities fail him, there is little left but the long, 
tedious, and often fruitless process of elimination. In the case of transposition ciphers of the 


1 Military Cryptanalytics, Part I, par. 17 (on pp. 20-21). 
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more complex type, the discovery of the basic method is often simply a matter of long and 
tedious elimination of possibilities. For cryptanalysis has unfortunately not yet attained, and 
may indeed never attain, the precision found today in qualitative analysis in chemistry, for 
example, where the analytic process is absolutely clear-cut and exact in its dichotomy. A few 
words in explanation of what is meant may not be amiss. When a chemist seeks to determine 
the identity of an unknown substance, he applies certain specific reagents to the substance and 
in a specific sequence. The first reagent tells him definitely into which of two primary classes 
the unknown substance falls. He then applies a second test with another specific reagent, 
which tells him again quite definitely into which of two secondary classes the unknown sub- 
stance falls, and so on, until finally he has reduced the unknown substance to its simplest 
terms and has found out what it is. In striking contrast to this situation, cryptanalysis affords 
exceedingly few ‘reagents’ or tests that may be applied to determine positively that a given 
cipher belongs to one or the other of two systems yielding externally similar results. And this 
is what makes the analysis of an isolated, complex cryptogram so difficult. Note the limiting 
adjective ‘isolated’ in the foregoing sentence, for it is used advisedly. It is not often that the 
general system fails to disclose itself or cannot be discovered by painstaking investigation 
when there is a great volume of text accumulating from a regular traffic between numerous 
correspondents in a large organization. Sooner or later the system becomes known, either 
because of blunders and carelessness on the part of the personnel entrusted with the encrypting 
of the messages, or because the accumulation of text itself makes possible the determination 
of the general system by cryptanalytic, including statistical, studies. But in the case of a 
single or even a few isolated cryptograms concerning which little or no information can be 
gained by the cryptanalyst, he is often unable, without a knowledge of, or a shrewd guess as to 
the general system employed, to decompose the heterogeneous text of the cryptogram into 
homogeneous, monoalphabetic text, which is the ultimate and essential step in analysis. The 
only knowledge that the cryptanalyst can bring to his aid in this most difficult step is that 
gained by long experience and practce in the analysis of many different types of systems. In 
this respect the practice of cryptanalysis is analogous to the practice of medicine: correct 
diagnosis is the most important and often the most difficult first step toward success.” 


c. The parallels between cryptanalytic diagnosis—‘“‘cryptodiagnosis”—and medical diagnosis are 
very striking.” Medicine is far from an exact science—it really is an art—and the same is true of crypt- 
analysis. In medicine, complete diagnosis is often accomplished only after an autopsy; in cryptanalysis, 
complete diagnosis is sometimes possible only after a body of cryptomaterials is in the hands of the 
nevertheless-quite-competent analyst. Or another way of looking at it is that in medical as well as in 
cryptanalytic diagnosis, success may come only after the patient is dead or the system has expired; in 
either case, an autopsy could tell us what we should have done. Even with (or in spite of) the present 
state of medical knowledge, the causes of many diseases and their cures are still unknown; in cryptanaly- 
sis, there are many cipher systems for which no general solution exists or is known, even if we know the 
basic principles of the system in question. 

d, Cryptanalysis may be thought of as consisting of two aspects, diagnosis and exploitation. Diagnosis 
of a cryptosystem is concerned with the discovery of (1) the nature of the basic elements (or tools) employed 
in the cryptosystem (e.g., the language, code book, additive key, transposition matrices, substitution 
alphabets), and (2) the rules by which a cryptographer uses these elements to convert plain text into en- 
crypted text; diagnosis continues as long as any element or any enciphering principle remains unknown. 
Exploitation of a cryptosystem is concerned with (1) the recovery of the basic elements (e.g., the code 
book, additive key, transposition key, substitution alphabets) and (2) the subsequent reading of the 
plain text, Although the functions of diagnosis and exploitation are distinct, it is a mistake to assume 
that one finishes before the other commences. In general, some recovery of particular elements is inci- 
dental to the diagnostic process; similarly, a system can be partially exploited before diagnosis proper 
takes place (e.g., isolated spelling-group messages in a low- or medium-grade system are often read 


2 See in this connection Lambros D. Callimahos, ‘‘Cybernetics and Problems of Diagnostics; the Parallels Between 
Medicine and Cryptanalysis,’”’ appearing in the NSA Technical Journal, Vol. XIV, No. 1, Winter 1969. 
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before the mechanics of the system are fully understood—in fact, they can form the starting point of the 
diagnosis). 

72. The basic steps in diagnosis.—a. The first attempt to formalize the discipline of diagnostics 
was made in 1563 by the Neapolitan physicist, physician, and cryptologist, Giovanni Battista della 
Porta; at the end of his treatise, De Occultis Literarum Notis, he appended a set of synoptic tables for 
cipher analysis, with bifurcated routes to be followed according to the particular phenomena displayed 
by the cipher under investigation. Three and a half centuries later there appeared, in 1918, a work by 
William F, Friedman entitled Synoptic Tables for the Solution of Ciphers, published by the Department 
of Ciphers of the Riverbank Laboratories at Geneva, Illinois, where Friedman was employed as a geneti- 
cist. This latter work consisted of nine tables, strictly dichotomous in nature, with which, it was hoped, 
an unknown system could be diagnosed. In the next attempt to devise synoptic tables for the analysis 
of cryptograms, Captain Roger Baudouin, in his Eléments de Cryptographie published in Paris in 1939, 
devised 17 tables which were to lay bare the cryptosystems of the moment. All of these attempts had 
something in common; they failed in their avowed purpose. The reason they failed is that, unfortunately, 
cryptodiagnosis does not Jend itself to scientific rigor such as the taxonomy of qualitative analysis in 
inorganic chemistry. The construction of dichotomous charts, or variations thereof, is useless in the 
analysis across the board of systems that turn up in operational practice. So much for synoptic tables. 

b. In Military Cryptanalytics, Part I, it was stated (on p. 18) that the art of cryptanalysis may be 
reduced to the following steps: 


Procedures tn cryptanalysts Requirements 
1. Arrangement and rearrangement of data to disclose Experience or ingenuity, and time (which 
nonrandom characteristics or manifestations (i.e., latter may be appreciably lowered by the 
in frequency counts, repetitions, patterns, sym- use of machine aids in cryptanalysis). 


metrical phenomena, etc.). 

2. Recognition of the nonrandom characteristics of Experience or statistics. 

manifestations when disclosed. 

3. Explanation of the nonrandom characteristics when Experience or imagination, and intelligence. 

recognized. 

This was followed by the remark that ‘In all of the foregoing, the element of luck plays a very important 
part, as it is possible to side-step a large amount of labor and effort, in many cases if hunches or intuition 
lead the analyst forthwith to the right path. Therefore, the phrase ‘or luck’ should be added to each of 
the requirements above. In fact, it all boils down to the simple statement: ‘Find something significant, 
and attach some significance thereto.’ ’’ All of this is of course an oversimplification ; nevertheless it is an 
accurate description of the procedures of cryptanalysis—and, actually, the steps of diagnosis. But, in a 
more sophisticated or modern approach, cryptodiagnosis may be regarded as consisting of two aspects: 
(1) hypothesis formulation and (2) hypothesis testing; the formulation of a hypothesis will call for a 
particular diagnostic test or tests, which in turn will or will not produce the phenomena expected for that 
hypothesis, enabling the cryptanalyst to derive a measure of acceptance or rejection of the hypothesis. 
This will be elaborated upon in succeeding paragraphs. 

73. The diagnostician and his attributes.,—a. What sort of person would we choose for the ideal 
diagnostician? What abilities, traits of character, and experience must he have? In order to answer 
these questions, we must look at the problem of diagnosis itself. In brief, the task of the diagnostician 
consists of collecting and organizing available material, searching for and recognizing phenomena, 
building up hypotheses and making every effort to knock them down again. Let us examine each stage 
and see what is required of our Compleat Diagnostician. 

b. While the collecting and organizing of material and relevant information may frequently not be 
under the diagnostician’s direct control, he must ensure that no useful evidence is beyond his reach. 
This means that he must be familiar with the collection process and must be able to specify the form 
in which the materia] is presented to him. With a fairly naive encipherment system, or in any case if 
there is not too much material, he should normally start with the hard copies of the intercepted messages 


3 This paragraph (‘‘The diagnostician and his attributes’) is taken, with but minor changes, from D. A. Wilson’s 
delightful paper, ‘‘Education in Diagnosis,” appearing in the NSA Technical Journal, Vol. XIV, No. 1, Winter 1969. 
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themselves, and preferably do his own logging of traffic, at least initially. With more sophisticated and 
more voluminous systems, he will be forced to make use of data processing machinery or a computer 
for logging or ‘“‘diarization’”’ (i.e., the process of indicating the positions at which interesting features or 
passages occur in the messages). Under these circumstances the computer may deign to show him only 
those stretches of materia] which it finds interesting. He must then firmly insist on seeing periodically a 
selection of “‘normal”’ traffic, in order that he may both remind himself of what normal traffic looks 
like and with luck find new phenomena which the computer blindly ignores. He must either himself 
be able to program or at least be able to communicate sensibly with the programmer. 

c. The diagnostic expert must also familiarize himself with the cryptographic background of the 
system. He must study both predecessor and contemporary systems which may have been conceived 
under the same roof, and he must know something about the users of the system and be able to deduce 
the likely degree of cryptographic sophistication and the required portability of the encipherment 
material. He must appreciate the value of external and nontextual features of the transmissions (the 
traffic analyst will probably be able to explain some, but not all of these), and he has to be familiar 
with the likely causes of busts, due both to faulty operators and, in the case of machine ciphers, to 
faulty machinery. 

d. Up to now, our Compleat Diagnostician appears as a technical administrator. The main quality 
required is the ability to digest large amounts of information and retain the main gist in the front of his 
mind while taking care not to push the smallest scrap out at the back. He must be thorough and careful. 
He also needs to have some organizational capability, a technical knowledge of cryptographic systems, 
transmission systems, and probably programming. 

e. Having put his material into a convenient form, the analyst enters the most critical stage of the 
diagnostic process. He has to search for, and find, phenomena. Without any phenomena to work with, 
diagnosis is impossible. The first thing to do is to look at the material. As I. J. Good remarks in his ‘‘Stand- 
ard Reagents and Diagnostician’s Dictionary,” it may be plain text! Even if it is not, interesting features 
may spring to the eye. Long repeats, limitations, suspicions of rough frequency counts, excesses of 
doublets, indications of a significant width, depths, isologs, indicators, and many more phenomena may 
be found in a quick, not necessarily systematic, look at a few messages. 

Jf. Unless enough evidence has now been found to have a first shot at establishing and testing a 
hypothesis, the diagnostician moves on to obtaining and examining descriptive statistics—numerical 
summaries of the material. Examples are frequency counts, repeat rates or indices of coincidence, 
pattern counts, and level and density counts of teleprinter text. Often these will be done on computers. 

g. Throughout this search, the analyst is on the lookout for anything out of the ordinary, any de- 
parture from normal procedure or normal-looking traffic, and also for any consistent feature throughout 
the traffic which would not be expected in a random sequence of letters. His main task is to decide 
which of the features he sees (or thinks he sees) are important in one of these ways. He must recognize 
phenomena; he must also recognize when a suspected feature is a nonphenomenon. 

h. The qualities possessed by our Compleat Diagnostician which make him an expert in finding 
phenomena are elusive. Certainly experience of phenomena which have proved helpful in the past is 
important. Knowledge of enciphering systems and their features, combined with the background in- 
formation of subpar. c may help hini to decide what to look for, but he does not blindly follow the path 
along which they lead: new systems usually have new features. It is not enough to say that he is ob- 
servant; the word is so general that in this context it is almost devoid of meaning. His powers of 
observation are peculiarly imaginative. While looking at his material he must have in mind a multiplicity 
of possible features he would like to find, but frequently the most important observations are phenomena 
he could not have forecast. He must have an appreciation of pattern, and his mind works in a way which 
would probably give him a good score in a diagrammatic intelligence test. Possibly sheer physical ocular 
athleticism or a wide field of vision may contribute. If we could define that something implicit in the 
statement that he has a cryptanalytic “green thumb” we would be much nearer to understanding the 
crux of the diagnostic process. It is this something that separates our Compleat Diagnostician from the 
run-of-the-mill analyst who views diagnosis as merely the application of a sequence of standard statistical 
tests. 

i. The assessment of the phenomena which have come to light requires a judgment of their value— 
a statistical common sense based on the concept, and frequently on the practical application, of sig- 
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nificance tests. Furthermore, the diagnostician realizes that some of his significant features may really 
be only subphenomena, and is always ready to hunt for related features which wil] support a more 
general hypothesis. For instance, having observed a significant number of repeats at a certain distance 
he will want to know whether this is supported by a rough digraph count at that distance, or by repeats 
at multiples or factors of the original distance. 

j. The next stage in the process is the setting up of hypotheses, to be followed by attempts to upset 
these same hypotheses. Each hypothesis should explain as many as possible of the observed phenomena. 
This explanation is then tested in two ways: first by deciding whether the remaining phenomena which 
have been seen conflict with the hypothesis, and second by predicting further phenomena which might 
be expected if the hypothesis is true and looking to see whether they exist. 

k. In the more naive systems the hypothesis will often be a complete tentative specification of the 
encipherment process, but this will rarely be the case with a sophisticated problem. Here the hypotheses 
will usually be either the restriction of the system to a general class (e.g., transposition of some kind, 
additive mod 26, binary linear recursive key), or a precise specification of some small detail (the existence 
of a Hagelin-type slide feature). The diagnosis of a sophisticated noncommercial machine may require 
the establishment of hundreds of viable partial hypotheses of this kind, gradually building up the com- 
plete picture from hosts of small details. 

l. Here our Compleat Diagnostician needs the qualities of imagination, impartiality, deduction and 
ability to synthesize—in short, he is a good research scientist. He must be imaginative in his construction 
of hypotheses, deductive in predicting resultant expected phenomena, and impartial in his interpretation 
of the results of the tests of his hypothesis. The synthesis of many partial hypotheses brings in again 
his grasp of previous and contemporary systems—which must also have contributed to his selection of 
hypotheses in the first place. In machine systems a working knowledge of mechanics, electromechanics, 
or electronics is needed to diagnose faulty conditions and to predict other faults which are likely to 
occur. 

m. Little has been said about the actual testing of hypotheses. Obviously our Compleat Diagnostician 
must be familiar with all the routine standard tests and conversant enough with testing theory to devise 
special tests where no appropriate ones are known. He must always ensure that his hypotheses can be 
tested—this will be a brake which keeps his imagination under control. Finally he remembers that the 
acid test of diagnosis is the reading of plain text, although the diagnostic process is seldom complete 
when the first sensible text emerges. 

n. This concludes the list of qualities peculiarly appropriate to the diagnostician. Add to these 
the attributes we like to see in any senior cryptanalyst (perseverance, the ability to communicate and 
to keep a record of ideas and results, drive, supervisory capabilities, sheer common sense, etc.) and the 
list becomes formidable indeed. We begin to understand why so few really first-class diagnosticians 
emerge from the maelstrom of the cryptologic community. 

74. Embarking on the unknown cryptosystem.—a. Let us suppose that we have been given traffic 
in an unknown cryptosystem and have been asked to solve the messages. In preparation for this likely 
event we will arm ourselves with information and facts, as outlined below. 

b. The first step should be to find out ajl that is known, communications-wise and cryptologically 
speaking, about the origin of the messages. Is the target country known, say, Zendia, or is it undeter- 
mined? If it is Zendia, we (or someone in the research section) should tap all information sources about its 
past cryptologic history and national cryptographic habits, and we should obtain at least a general 
familiarity with its language, geography, political and military structure, industrial resources, and key 
personalities. If information on past cryptologic history is sparse, we take into account information on 
countries with which Zendia has an alliance, in case there is foreign influence in her communications. 

c. We endeavor, through traffic analysis and other sources, to determine who the users of the crypto- 
system might be—army, navy, air force, ambassadors, police, etc.—and in so doing, we make conjectures 
as to the probable content of the messages. We take note of the extent of use of the cryptosystem, and 
construct a cryptonet diagram. 

d. If there is a predecessor system that has been read, we study decrypts and take note of the subject 
matter treated. Is there a high incidence of stereotyped beginnings or endings, or are there fairly rigid 
formats to some of the messages, and if so, between what stations or organizations? What procedures 
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are there, if any, for the use of nulls, message bisection, and padding, and what conventions are there for 
the spelling out of digits? On what links or lanes have exploitable violations or weaknesses occurred in 
the past? 

e. If the cryptosystem does not have a readable predecessor, does plain-language traffic intercepted 
on the links carrying the encrypted traffic yield any information that might be used as a break-in into 
the system? Is there any information of potential cryptanalytic value in the associated chatter? Do other 
intelligence sources yield any information of use? Do the formats of the messages (e.g., 5-digit, 4-letter), 
or the traffic volume, or the message lengths (e.g., a preponderance of messages exactly 32 groups long) 
give any suggestions as to the probable system? What are the probable cryptosecurity requirements of 
the system? If it is military traffic at corps or army level, the security of the system is expected to be high, 
possibly machine cipher, used under favorable operating conditions, with sufficiently rugged equipment, 
operated by personnel with adequate training. On the other hand, military traffic at, say, regimental 
level may be expected to be less secure, possibly a manual system, one which might be used under un- 
favorable operating conditions by personnel inadequately trained and under pressure of time or the 
exigencies of combat conditions. What is the probable reason for the introduction of the system; or, if 
it has a predecessor, the reason for the change of system? 


Jf. Where the language of the encrypted messages is known or can be assumed, it goes without saying 
that we should equip ourselves with the necessary cryptolinguistic letter frequency and other data that 
will aid us in our analysis. All too frequently, especially in the rarer languages, such information has not 
been compiled in sufficient detail, or its existence is unknown, or worse yet, cannot be found. 


75. Preliminary actions in attacking the unknown cryptosystem.—a. Let us assume that a pile of 
5-letter traffic in an unknown cryptosystem has been placed on our desk. The messages bear an apparent 
discriminant, DICID, in the Al position; therefore they may be presumed to be homogeneous.* The 
nationality of the target is uncertain, but the nets on which the traffic has been intercepted are presumed 
to be Zendian. We have taken into consideration the points discussed in par. 74, and we have rolled up 
our sleeves in preparation for the battle of wits: our cryptanalytic prowess against the enemy’s crypto- 
graphic strength. 

b. We begin by leafing casually, even unsystematically, through the messages, to see what we can 
see—and at this stage we really don’t know what we expect to see—it suffices to keep an open, observant 
mind.’ After a brief period of sampling the visible ‘‘flavor’” of the messages, looking for anything that 
seems peculiar or out of the ordinary, we sort the traffic with the idea of assurance of maximum crypto- 
graphic homogeneity. If we have enough traffic, we can afford to restrict ourselves to sorting the traffic 
by net or even link, and within that by date; otherwise, we would be content with logging one or two 
months’ messages, say, in date-time ° order. The logs optimally should contain all of the elements of the 
preamble and, say, the first five and last five groups of text. (If the volume of the traffic is too great, 


4 Homogeneity is a relative term, with different meanings in different contexts: in speaking of an enciphered code sys- 
tem, homogeneous traffic might be considered as embracing messages encrypted with the same code book and additive 
book; in a machine system, homogeneous traffic might be interpreted as consisting of messages enciphered with the same 
internal pin- and lug-settings, or the same rotor order; in a transposition system, homogeneous messages might be thought 
of as those enciphered with the same matrix and transposition key; in a Playfair system, since there is only one variable, 
viz., the Playfair square, homogeneous messages would be those enciphered with the same square. These are anything 
but precise definitions; for example, if the enemy were using several types of code and enciphered code systems, and also 
Playfair systems, the several different Playfair systems taken together might be considered as a homogeneous grouping 
vis-4-vis the other nonrelated systems. In the case at hand, since the Al groups of all the messages are the same 5-letter 
group, DICID, the traffic is homogeneous to that degree. But there are varying degrees of homogeneity: there might be 
another nontextual indicator among the groups of the message (or even in the preamble) which could further delimit the 
homogeneity; or only the traffic within a certain time period (e.g., month, week, day, 6 hours) might be homogeneous in 
the second degree; or only the traffic within a particular geographical area; or only traffic within a specified net or link, or 
even lane; or, for that matter, only traffic from a particular originator, regardless of addressee. 

5 A mistake, unfortunately all too common in operational practice, is disassociating plain-language messages and 
chatter from the encrypted traffic before it gets to the cryptanalyst. We should endeavor to examine the rolls of intercept 
copy as they come from the intercept operator, before they are cut up and the encrypted messages removed. Also, in 
sorting out duplicate messages, we should make sure that apparent “‘duplicates”’ are not really bust messages: fingers have 
been burnt in this situation more than once. 


6 File date-time, when this is in the preamble or postamble, and not intercept date-time. 
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’ this would call for the logs to be prepared by machine methods; otherwise, hand logging should suffice *— 

_ besides, we would become more intimately familiar with the traffic if the messages were logged by hand. 
Even if the logs are made by machine, it might not be a bad idea to take a limited amount of material, 
say an active link on a particular day or week, and log that much by hand for its instructional value.) 
The logs are then examined to see if anything of interest turns up; e.g., repeated groups between the 
messages near their beginnings or endings, limitation or association of characters near the beginnings 
and endings, or any correlation between preamble components and text groups. Columnar frequency 
counts of the a, 6, c, d, and e positions of the A2 (and perhaps the A3) groups of the messages are taken; 
if the A2 (or A3) is an indicator group, such counts might reveal limitations or other phenomena often 
associated with indicators. Similar counts might be made with the ZO and Z1 groups. 

c. We now examine the messages themselves, assisted by our log. We take a good look at the mes- 
sages having (1) the same serial number (i.e., station serial number, or message center number if there 
be one), (2) identical A2 groups (or if an indicator were not apparent as in this DICID system, identical 
Al groups), (3) identical file date/times, (4) identical group counts, (5) sequential station serial numbers, 
(6) limitations in the beginning or ending groups, (7) polygraphic repetitions in the beginning or ending 
groups, either within or between messages, and (8) isomorphic beginnings or endings, which might arise 
from identical underlying plain text enciphered by different keys. Traffic emanating from each originator 
is compared, taking special note of messages going to the same addressee; and it might not be amiss, 
for that matter, to compare traffic going to each addressee, taking note of messages from the same orig- 
inator. Traffic from both ends of a link is compared for possible polygraphic repetitions or other phe- 
nomena between messages which might earmark the use of identical keys (even including a mistake 
in the use of the wrong pad in a one-time-pad system which could then enable the reading of the re- 
sultant two messages in depth if the components are known or can be assumed). We also keep our eyes 
open for sets of messages that are likely to have similar—perhaps even proforma—content, which 
might be profitable to study separately. Practice traffic, if identified at this stage, should be removed 
from the message file. Suspected bust messages, resends, isologs, staggers, and any unusual situations 
should be worked on without delay; but we should be reasonable about the time spent on unsystematic 
fiddling at this stage. We study the group counts of the messages for evidence of key-length limitations 
and number of nontextual groups, and we do the ‘remainder test” for evidence of the length of the 
underlying cryptographic units. 

76. First step: manipulating the data.—a. At the outset, it should be clear why diagnosis in crypt- 
analysis is at all possible: the plain text underlying cryptograms has pronounced properties of frequency 
variation and repetition, and these properties can be made to show through the cryptographic disguise 
by proper manipulation of the encrypted text. It is obvious that if the underlying text were flat, having 
no properties distinguishable from random, nothing would be manifested in its encryption, no matter 
what striking properties or characteristics were inherent in the application of the cryptosystem. In 
other words, flat ‘‘plain text” plus key, no matter how rough, will yield flat (i.e., random) cipher. But 
the converse is also true: rough plain text plus flat key will also yield flat cipher. Therefore, as long as 
the cryptosystem has sufficiently nonrandom properties in its make-up, if the underlying plain text has a 
characteristic roughness, diagnosis and solution are possible. But given the case of the encryption of plain 
text in a one-time-pad system in which the key is produced by a random process and has no limitations, 
characteristics, or patterns that are distinguishable from random, and where neither the key nor any 
portion of it is ever used again for the encryption of another message, solution is demonstrably impossible. 

b. Even in the absence of cryptanalysis of messages, the patent characteristics of the encrypted 
texts and the manner in which traffic is passed from originator to addressee can yield information when 
there is either adherence to or departure from established norms: this is the essence of traffic analysis.® 
For example, three-letter traffic suggests a three-letter code system; the composition of a radio net 
and the manner of its working yield information on the relative subordination of the units or organiza- 
tions involved; the relaying of a message from A to B to C discloses the existence of certain information 
channels, and if the message is reencrypted on the second leg of its journey an isolog will be produced ; 


7 As we log each message, we look over the entire text, to catch anything that might be unusual. 
8 See in this connection par. 74 of Appendix 7 (‘“Communication Intelligence Operations”), Military Cryptanalytics 
Part IT, and also Appendix 7 (“Introduction to Traffic Analysis’), Military Cryptanalytics, Part IJ. 
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a sudden increase in traffic volume on a particular link or net, which had been stable for some time, can 
be the prelude to an impending operation or activity. 

c. When we manipulate data from the texts of messages, we are looking for characteristics of the 
underlying plain text to show through in some degree. When we examine our traffic logs, we look for 
signs that are characteristic, for example, of isologs, retransmissions, apparent mistakes of communica- 
tions or cryptography; we find these because we know how these features are reflected in the logs. For 
example, in searching for isologs we look for messages of the same or nearly the same group count, sent 
within a relatively short time span (say, from less than an hour up to a day or two) from one originator 
to (preferably) the same addressee, or sent from an originator to two or more (possibly subordinate) 
addressees; and we also look for isologs on other legs of possible relays. Mistakes (so-called ‘“‘busts’’) 
can be uncovered by astute observation, or we can also be helped immeasurably by operator chatter 
such as ‘‘You set the 47-wheel incorrectly, you blithering idiot!’ which tells us that the cryptosystem is 
in all probability a machine system, and that the machine has a ‘‘47-wheel”’ (this might be either a 47- 
point wheel, or one with 47 marked positions on it, or simply a wheel marked ‘‘No. 47”). 

d. In this numbered paragraph, emphasis will be placed on the manipulation of data to uncover 
nonrandom characteristics or manifestations. Par. 77 deals with recognizing phenomena, and par. 78 
with interpreting phenomena; but because cryptodiagnosis really does not keep entirely separate the 
steps of manipulating data and recognizing and interpreting phenomena, the discussion in pars. 76-78 
perforce will overlap in these aspects. 

e. The study of the group counts of messages can yield information of considerable iniportance to 
the cryptanalyst, as can be shown by the two examples which follow. In studying these group counts, 
we could make a simple tabulation in group-count order; we could group the data into classes such as all 
messages of group counts 21-25, 26-30, etc.; we could group them into two classes, those messages with 
an odd number of groups, and those with an even number; or we could study the group counts of messages 
(1) having a particular discriminant or indicator, (2) sent by a particular station, or (3) sent at a par- 
ticular time of the day. The data manipulation in the two examples below consists merely of recording 
the group counts in a form suitable for study: in this case, in group count order. 

(1) For the first example, the group counts of 100 messages have been tabulated; the traffic (ap- 
parently high-grade because of the importance of the users, and also because of the lack of 
visible properties) consists of messages sent in 5-digit groups, with a group count range of 21-99. In the 
diagram below, the columns labelled ‘“‘GR” are the group counts, the columns labelled ‘““Msgs” give the 
number of messages having the particular group count. The striking peaks at group counts of 32, 63, 
and 94 are noted. As a possible explanation of this phenomenon, we could arrive at the hypothesis (1) 
that there is involved a key book containing blocks of 30 key groups each, or a stencil system with 30 
5-digit key-groups exposed by the apertures, (2) that the location of the first block is given by two 
indicator groups, and (3) that subsequent blocks require but one indicator group to designate their 
location. Under this hypothesis, then, it would be possible to have a 32-group message, but not 33, 
because the next greater length would have to be 34: 32 groups for the first block including the indicators, 
and one more indicator plus one more text group. Likewise, the next message length after 63 groups must 
be 65, and the next after 94 must be 96.This hypothesis is strengthened by the absence of messages having 
group counts of 33, 64, and 95. A further hypothesis is made that the underlying text is cipher text 
rather than code text. The reasoning behind this assumption is that the cryptographic clerk, mindful of 
the key-length limitation of 30 groups, tries out of either laziness or economy not to go only one or two 
groups beyond the block limitation; thus, he might abbreviate a signature, or spell the last STOP or two 
as “STP,” or make other slight changes—easier in a cipher system than in a code system—to avoid 
exceeding the imposed limitation. And as for the reason why the preponderance of plain texts happens to 
be groups of 30 and its multiples, perhaps it is because of the particular contents of the messages, or 
because of certain habits being followed as regards padding to fill out a convenient 30 groups—quién 
sabe? With further examination and analysis of the traffic, we should be able to prove or disprove our 
hypotheses—at least we have made a beginning, and we can pursue the trail we have hewn for ourselves. 


—~SECREL_ 330 








GR Msgs GR Msgs GR Msgs GR Msgs GR Msgs GR Msgs GR Mags GR Msgs 
21 1 31 1 4] 51 1 61 4 71 1 81 91 2 
22 1 32 «6 42 2 52 1 62 1 72 2 82 2 92 2 
23 1 33 43 53 2 63 8 73 83 93 

24 34 1 44 1 54 64 74 2 84 ] 94 5 
25 1 35 3 45 2 55 4 65 1 75 85 1 95 

26 36 38 46 56 66 1 76 2 86 96 

27 1 37.2 47 1 57 1 67 77 1 87 1 97 1 
28 38 1 48 58 1 68 2 78 2 88 98 1 
29 1 39 49 2 59 2 69 79 89 1 99 I 
30 1 40 50 3 60 4 70 1 80 1 90 2 100 

Ficure 166 


(2) For the second example, we shall study the group counts of 200 messages from an actual opera- 
tional situation. The traffic, presumably high-grade, consists of messages sent in 5-digit groups, and the 
group-count range is from 23 to 100 groups. 





tpt 


o 


Oe, 


GR Msgs GR Msgs GR Mscs GR Msgs GR Msgs GR Msgs GR Mags GR Msgs 
21 31 1 41 1 51 1 61 4 71 4 81 4 91 ] 
22 32 1 42 4 52 62 4 72 1 82 5 92 1] 
23 1 33 43 1 53 4 63 3 73 3 83 1 93 2 
24 34 1 44 1 54 5 64 2 74 8 84 2 94 2 
25 350 3 45 1 55 4 65 4 75 6 85 3 95 1 
26 1 36 2 46 3 56 4 66 7 76 2 86 6 96 2 
27 37 1 47 1 57 1 67 1 77 1 87 3 97 1 
28 1 38 «2 48 2 58 6 68 4 78 6 88 4 98 4 
29 39°C 49 1 59 4 69 4 79 4 89 1 99 1 
30 40 1 50 5 60 4 70 9 80 3 90 4 100 2 
Ficure 167 
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If nothing about the traffic were known, it would be wise to determine the size of the underlying crypto- 
graphic units, if possible, and also uncover any evidence as to the existence of nontextual groups that 
might be indicators. The procedure called for here is the remainder test, applicable when the last group 
has been padded with an indeterminate number of disguised nulls necessary to complete the group. If 
the text is sent in 5-chsracter groups, the modular (remainder) counts after dividing by 2 (testing for 
underlying dinomic text), by 3 (for trinomic text), and by 4 (for tetranomic text) have the following 
expected percentages: ° 


Dinomic Trinomic Tetranomic 
2N + 0 = 60% 3N + 0 = 40% 4N + 0 = 40% 
2N + 1 = 40% 8N + 1 = 20% 4N + 1 = 20% 
3N + 2 = 40% 4N + 2 = 20% 
4N + 3 = 20% 


If the underlying text is pentanomic, or if it consists of irregular-length units, the remainder test will be 
inconclusive. (Parenthetically, tetranomic text when examined on a dinomic basis also gives a distribution 
of 60% and 40% for remainders of 0 and 1, respectively, but there is no confusion since the tetranomic 
examination will give its proof. If, however, dinomic text is examined on a tetranomic basis, the distri- 
bution will be 30%, 20%, 30%, 20% for remainders of 0, 1, 2, and 3, respectively.) As an illustration, 
if the underlying text is, say, trinomic, the messages with group counts exactly divisible by 3 with no 
remainder will account for 40%, those with a remainder of 1 will account for 20%, and those with a 
remainder of 2 will account for 40%. If, however, there is one nontextual group present, the counts will 
be shifted cyclically one position downward, resulting in a distribution of 40%, 40%, 20% for remainders 
0, 1, and 2; and if there are two nontextual groups present, the counts will be displaced cyclically two 
positions downward, resulting in a distribution of 20%, 40%, 40% for remainders 0, 1, and 2. In the 


® The reason for these percentages is not difficult to see. Taking the example of underlying dinomic text, we might 
have to add 1, 2, 3, or 4 nulls to complete the final group, unless it is already a complete group of five; thus we have the 
following five cases: 


12121 21212 (2N+0) 
12121 21212 12XxxX (2N+1) 
12121 21212 1212X (2N+1) 


12121 21212 12121 2XXXX (2N+0) 
12121 21212 12121 212XX (2N+0) 


omore 


It can be seen that in three of the five cases (60%) the group counts of messages are exactly divisible by 2 with no re- 
mainder, and in two of the five cases (40%) there is a remainder of 1. In underlying trinomic text, we have the following 
five cases: 


a. 12312 31231 23123 (3N+0) 
b. 12312 31231 23123 123XX (SN+1) 
ce. 12312 31231 23123 12312 SXXXx (3N+2) 
d. 12312 31231 23123 12312 3123x (SN+2) 
e. 12312 31231 23123 12312 31231 23XXX (3N+0) 


In two of the cases (40%) the group counts are exactly divisible by 3, in one case (20%) there is a remainder of 1, and in 
two cases (40%) there is a remainder of 2. In underlying tetranomic text, we have the following five cases: 


a. 12341 23412 341235 41234 (4i1+0) 
b. 12341 23412 34123 41234 1234xX (4N+1) 
c. 12341 23412 34123 41234 12341 234xx (4N+2) 
d. 12341 23412 34123 41234 12341 23412 34Xxx (4N+3) 
e. 12341 23412 34123 41234 12341 23412 34123 4XXXX (4N+0) 


In two of the cases (40%) the group counts are exactly divisible by 4, and in the remaining three cases there is one case 
each (20%, 20%, 20%) of remainders of 1, 2, 3. 
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‘ example given in Fig. 167, the group counts have the following remainders when examined on hypotheses 
of underlying dinomic, trinomic, and tetranomic text: '° 


Dinomic Trinomic Tetranomic 
2N + 0 = 121 (60.5%) 3N + 0 = 67 (83.5%) 4N + 0 = 39 (19.5%) 
2N + 1 = 79 (89.5%) 38N + 1 = 63 (31.5%) 4N + 1 = 36 (18.0%) 
3N + 2 = 70 (35.5%) 4N + 2 = 82 (41.0%) 
4N + 3 = 43 (21.5%) 


It is clear that the underlying text must be tetranomic, and that there are two nontextual groups 
(probably indicators) present." 

f. An important phase of cryptanalysis, one which can be crucial especially in the early stages of 
analysis, is the study of indicators. In general, there are two kinds of indicators: (1) system indicators 
(also called ‘discriminants’”’), which define the sets of cryptomaterials used, and (2) message indicators, 
which define the specific application of the cryptomaterials or keys. Indicators may be recognized as 
such (1) if they are repeated in the message text; (2) if they possess distinctive patterns; (3) if they have 
limitations or characteristics in their elements; (4) if there are associations in the messages between the 
indicators and another group (which may be a text group, a second indicator, or an indicator check group) ; 
(5) if there are associations between the indicator and some element or elements in the preamble; or (6) 
if they have a roughness different from that of the message texts. These several aspects will now be 
illustrated. 

(1) Below are exemplified sets of groups with patently obvious patterns and characteristics, different 
from the rest of the message texts, which categorize them as indicators: 


(a) (b) (c) (d) (e) (f) (g) (h) 
COBRA BABAX AIRBC ZEBEC DARIC 59329 81473 LAMIV 
GRAVY NONOX EGQBC ZEVUB GOSUK 07726 04739 DCGBI 
ALBUM PIPIX EFNBC ZEMIN JENIM 83573 35320 CVYML 
NYLON GAGAX BKRBC ZESOW CUVOD 30317 52691 RBTTN 
BONUS ZUZUX DGOBC ZEDIG MIWEH 92102 29903 VCYLK 
EAGLE MEMEX AJLBC ZELEM BORAB 14230 ‘75858 MIVFB 
ROYAL TUTUX CFLBC ZEWIZ BOQAC 48754 18761 ZDDTX 
YODEL DODOX BIPBC ZEDAD LAZUF 25186 93227 HSACD 
GLORY HAHAX DJLBC ZEZUF HIXEB 31947 43042 QGXRP 
LIVER QEQEX CHMBC ZECOG KUTIL 73820 56435 TPJLV 


10 The easiest way to take remainder counts is with a desk calculator, ‘“‘zoning’’ the keyboard into four (and then three) 
areas with the column markers, and recording the group counts four (and then three) at a time from the group-count 
record sheet: the accumulated totals will appear in the four (and then three) areas of the indicating dials. The remainder 
counts for the dinomic hypothesis are obtained easily from those of the tetranomic hypothesis, by adding together the 
counts of remainders 0 and 2, and those of 1 and 3: these are now the dinomic remainder totals for 0 and 1, respectively. 

"Note, as an additional example, the remainder counts of the 100 messages given in Fig. 166: 


Dinomic Trinomie Tetranomic 

2N + 0 = 52 38N + 0 = 34 4N + 0 = 25 
2N 4+ 1 = 48 38N + 1 = 32 4N + 1 = 21 
3N + 2 = 34 4N + 2 = 27 

4N + 3 = 27 


The remainder test here is inconclusive, showing that the underlying text either is pentanomic or consists of units of 
irregular length. Since in that example we had come to a conclusion that the underlying text was cipher rather than code, 
we can arrive at the tentative hypothesis that what we are faced with is probably an enciphered monome-dinome system. 
As a parenthetical aside, it is important when employing the remainder test (1) that the material under study be homoge- 
neous, and (2) that the group counts are not biased in favor of a particular group count, which might give misleading 
results. 


333 —SiGhet— 


206-687 O - 77 ~ 22 





—~SECRET— 


In set (a) the indicators are self-evident, with 5-letter dictionary words used to convey the specific 
keying information; set (b) apparently embraces a potential 100 (or perhaps 120) keys or starting posi- 
tions; set (c), 210 keys or starting positions; set (d), 100 keys or starting positions; and set (e), 2500 
keys or starting positions. From sets (d) and (e) we may reconstruct the permutation tables ” involved, 
supporting our contention as to the total number of possible indicators. Set (f) consists of sum-checking 
groups, and set (g) consists of groups self-summing to a constant 3, mod 10. Set (h) is harder to analyze, 
but on close examination it is seen that the middle letter is the mod 26 sum of the first two, and the last 
letter is the mod 26 sum of the third and fourth letters. 


~18 USC 798 
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(4) When indicators are enciphered, particularly in numerical cryptosystems, an additive key for 
encrypting the plaintext indicator has often been taken from a text group or groups near the beginning 
of the message or near the end. (Sometimes elements of the preamble, such as the group count, the message 
center number “—if there is one—or the file date/time have'also been used as key.) These latent indicators 


18 The message center number (abbreviated ‘“MCN’’) is a serial number assigned by a message center; this should not 
be confused with the station serial number (abbreviated ‘“NR’’) which is that assigned by the radio operator to all mes- 
sages in order of their transmission. . 
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are made patent by manipulation; subtracting all pairs of groups digit-by-digit, say Al to A5 and Z4 
to ZO, might uncover relevant phenomena. Let us study the following example of a log: 


To From NR FDT GR Al A2 A3 A4 A5 Zl ZO 


DRW WTZ 451 160752 62 30303 67470 82148 08651 32823 | 06647 09584 
DRW WTZ 452 160805 81 30303 21387 46095 50582 23172 | 53594 08128 
DRW WIZ 453 160817 65 30303 74582 98111 74502 8410270193 85211 
DRW WIZ 454 160824 46 30303 82083 05559 64462 29489 | 54930 38196 
DRW WTZ 455 160830 84 30303 51756 74288 10975 66593 | 34461 28475 





Since the Al is patently a discriminant, there might be an indicator in the A2 position; and if a text group 
is used for encipherment of the indicator, testing various groups near the beginning or end as trial 
additives might uncover some phenomenon. In the case at hand, subtracting the A3 from the A2 groups 
yields the following: 

85332 

85392 

86471 

87534 

87578 


The fact that the a and 6 digits sum toc, and that the numbers are in ascending sequence, is very interest- 
ing. Further study discloses an even more interesting phenomenon: since there are two nontextual groups 
(the discriminant and indicator), if we deduct 2 from each of the-group counts, we can show that the 
messages are “‘tailing,”’ with the system incorporating 1010 additive pages of 100 groups each and the 
coordinates in normal order.** Note that we could have seen the relationship between the A2 and A3 groups 
by differencing: the vertical differences between the a positions of the groups in the A2 column match 
the differences of the a positions of the groups in the A3 column; furthermore, the vertical differences in 
the A2 and A3 groups of the top two messages have the first trinome in common, as is also the case with 
the vertical differences of the last two messages. 
(5) In the next example, 


To From NR FDT GR Al A2 A3 A4 A5 Z1 ZO 


CLD SJO 827 171155 95 11033 14571 58536 64823 37867 | 83165 27120 
CLD SJO 828 171224 56 11033 38649 16650 19091 45648 | 56692 34603 
CLD SJO 829 171243 58 11033 81101 38012 48610 45432 | 66482 1353593 
RGF SJO 361 171258 70 11033 79374 00559 60726 02491 | 41273 72458 
RGF SJO 362 171319 83 11033 23070 13078 ‘70066 06315} 58817 48815 





“Tn the diagram below we have plotted the message starting points and their lengths. Message no. 451 began at 
coordinates 3-2 for a total of 60 tert groups ending at position 9-1; no. 452 began with the very next key group (9-2) for 
79 text groups, ending at position 7-0; no. 453 began at position 7-1 and ended at position 3-3; no. 454 began at 3-4 and 
ended at 7-7; and no. 455 began at 7-8 and must have ended at 5-9. 


0123456789 
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- the plaintext indicators underlying the A2 groups are uncovered by using the Z1 groups as key, recogniz- 
ing the indicators as such on the basis of the sum-checking digits in the ¢ position; had there not been this 
property of the indicators, an additional trial of the ZO groups as key for the A3 groups would reveal the 
following deciphered indicator groups: 


31416 31416 
82057 82057 
25729 25729 
38101 38101 
75263 75263 


Differencing techniques here too can reveal the existing relationships in the example above. The differ- 
ence between a pair of A2 and A3 groups will be found to be the same as the difference between the Z1 
and ZO groups of the same message. 

(6) The preceding example had the plaintext indicators repeated in the A2 and A3 groups. In the 
next example, 


To FromNR FDT GR Al A2 A3 A4 A5 Z1 ZO 


CTX LFY 392 180806 81 55555 34464 40158 20920 96282 | 92540 91715 
TIF LFY 807 180821 24 55555 93215 83125 36436 ‘78925 | 90360 01133 
OLZ LFY 496 180828 35 55555 66641 13894 05305 48820 | 46652 13841 
FHJ LFY 112 180845 60 55555 43193 79067 46951 94151 | 16094 335057 
JRU LFY 504 180905 54 55555 75541 32884 27036 57595 | 91953 09218 


applying the ZO groups as key for the A2 groups yields sum-checking ¢ digits as the only noticeable 
property. But if we subtract the ZO groups also from the A3 groups, we have the following: 


43759 59443 
92182 82092 
53800 00053 
10146 46010 
76333 33676 


The two separate indicator elements ab and de in the A2 groups have been transposed in the A3 groups 
to avoid a simple repetition of the indicator. In this example had we differenced the A2 and A3 groups, 
we would have uncovered the sum check in the ¢ position, since the effect of the ZO group would have 
been cancelled. 

(7) For the next example we shall consider the following log: 


To FromNR FDT GR Al A2 A3 A4 Ad Z\ ZO 


LXM ZZA '739 191447 67 67890 27312 97444 61173 81932 ; 61179 31051 
LXM OXL 624 191520 49 67890 56749 00750 18548 07446 | 23799 62749 
LXM NZM 124 191555 93 67890 03990 36773 56735 18857 | 52724 89122 
LXM DXY 368 191614 85 67890 05209 24516 79381 83011 | 94912 98336 
LXM KIR 902 191637 72 67890 50825 63650 73362 44065 | 66430 86021 


This case is related to that in subpar. (6); the A2 and A3 groups contain the underlying indicators, and 
the keying groups are the A4 and ZO groups. The second indicator is the same as the first, except that 
instead of summing the ad digits to ¢, the cd digits are summed to e, thus: 


66249 66493 
48201 48011 
57265 57651 
36928 36280 
875635 87639 
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Here the relationships are harder to spot, but the difference between the ab digits of the A2 group and 
those of the A3 group will be the same as the difference between the ab digits of the A4 group and those 
of the ZO group. 

(8) Thus far in our examples the indicators have been in a fixed position in the body of the messages. 
The next case incorporates “floating indicators,” with predetermined rules as to their location in the 
messages: 


ZO 


21798 
29317 
05132 
T7857 
17872 
46549 
89235 
86403 
09960 
29780 


From NR FDT GR Al 


HOU '751 210912 68 98765 
HOU 751 220840 85 98765 
HOU 751 230811 98765 
HOU 752 230837 98765 
HOU 753 230950 98765 
HOU 754 231102 98765 
HOU 751 240815 98765 
HOU 752 241047 98765 
HOU 753 241203 98765 
HOU 754 241321 98765 


A2 


69334 
60943 
67523 
00056 
T1342 
14684 
58537 
42019 
44181 
51870 


A3 


39494 
67038 
84674 
81271 
T5778 
40901 
10507 
95611 
59813 
72113 


A4 


63952 
TO02TT 
43996 
15763 
56826 
85617 
92279 
21290 
62977 
49999 


A5 


24ATST 
05392 
81846 
45263 
96091 
22495 
28474 
25709 
48329 
68212 


Z1 


19070 
17176 
76694 
56082 
735637 
34301 
68925 
21960 
47713 
99837 








MDX 
MDX 
MDX 
MDX 
MDX 
MDX 
MDX 


This is more difficult of analysis, but the trial application of the ZO group against the beginning groups 
of the messages yields the following at the indicated positions: 











To From NR FDT GR AI A2 A3 A4 A5 

MDX HOU 751 210912 68 98765 48646 ..... ..... ..... 
MDX HOU 751 220840 85 98765 ..... A8B721 ..... 1.1... 
MDX HOU 751 2350811 43 98765 ..... ..... 48864 ..... 
MDX HOU 752 230837 59 98765 ..... ..... 48916 ..... 
MDX HOU 753 230950 17 98765 ..... ..... 49054 ..... 
MDX HOU 754 231102 46 98765 ..... ..... 49178 ..... 
MDX HOU 751 240815 74 98765 ..... ..... ..... 49249 
MDX HOU 752 241047 68 98765 ..... ..... ..... 49306 
MDX HOU 753 241203 37 98765 ..... ..... «1... 49469 
MDX HOU 754 241321 37 98765 ..... ..... «1... 49532 


The rule for placing the floating indicator is not difficult to see: the units digit of the date governs the 
location of the indicator in the first 10 groups of the message, after the discriminant. Note also the last 
two 37-group messages, sent by an originator to the same addressee, a little over an hour apart; they 


may be isologs. 


(9) The following example involves another case of floating indicators: 


To 


ITV 
ITV 
ABS 
DLL 
ITV 
KZN 
USR 
ITV 
USR 
ABS 


From NR FDT GR Al 


A2 


A3 





SKG 201 250600 64 24680 
SKG 202 250637 81 24680 
SKG 751 250654 24680 
SKG 401 250745 24680 
SKG 203 250801 24680 
SKG 601 250836 24680 
SKG 551 250855 24680 
SKG 204 250916 24680 
SKG 552 250941 24680 
SKG 752 251137 24680 


49951 
20531 
30825 
71010 
25459 
59825 
62865 
91342 
12787 
38095 


338 


05973 
90244 
33446 
56895 
32083 
34904 
88255 
18577 
89220 
25720 


A4 


A5 


Zl 


Z0 





17328 
59455 
99810 
00313 
81420 
28755 
T3903 
80532 
86111 
05164 


19856 
34690 
85035 
T8387 
61717 
99683 
37875 
17122 
15909 
10654 


16096 
83026 
26193 
52886 
76691 
46875 
93751 
68066 
21642 
85863 


31859 
42522 
11881 
58753 
47303 
11595 
95778 
13001 
01989 
27886 
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This, too, is difficult of analysis, but the trial application of the ZO group against the beginning groups 
of the messages yields the following at the indicated positions: 


To FroomNR FDT GR Al A2 A3 A4 Ad 


ITV SKG 201 250600 64 24680 ..... 1.1... 10... 88007 
ITV SKG 202 250637 81 24680 88019 ..... ..... 12... 
ABS SKG 751 250654 53 24680 ..... ..... 88039 ..... 
DLL SKG 401 250745 72 24680 ..... BB1L42 eck eee 
ITV SKG 203 250801 46 24680 88156 ..... ..... 10... 
KZN SKG 601 250836 79 24680 ..... ..... «1... 88198 
USR SKG 551 250855 78 24680 ..... ..... 88235 ..... 
ITV SKG 204 250916 81 24680 88341 ..... ..... «6... 
USR SKG 552 250941 87 24680 ..... 88341 ..... ..... 
ABS SKG 752 251137 63 24680 ..... ..... 88388 ..... 





After a few moments’ study we arrive at the rule for placing the floating indicator: the units digit of the 
group count, mod 5, governs the placement in the first five groups after the discriminant. Note also the 
two messages with the same indicator, 88341, which could be a possible depth: 


To FromNR FDT GR Al A2 A3 A4 A5 


ITV SKG 204 250916 81 24680 (88341) 18577 80532 17122 . 
USR SKG 552 250941 87 24680 12787 (88341) 86111 15909 . 





The a digits of the first three text groups (1, 8, 1) hit in the two messages, and the 6 digits of the three 
text groups yield even differences between the two messages; if there is a high hit rate among the a 
digits in the two messages as superimposed," or if the even differences of the 6 digits prevail,'® we shall 
have proof that the messages are in depth. 

(10) As the fina] example of enciphered indicators, let us study the following log: 


To FromNR FDT GR Al A2 A3 A4 A5 Zl ZO 


CBI BOW 002 010832 68 135579 59361 53381 82796 87762 | 823503 01952 
CBI BOW 001 030816 46 13579 03530 18529 68995 43932 | 77362 25994 
CBI BOW 002 040820 50 13579 13891 24972 17752 54294 | 83479 13151 
CBI BOW 005 0'70848 82 13579 55748 57242 45415 99143 | 06959 50829 
CBI BOW 001 110800 95 13579 53311 68617 27855 91717 | 88907 50983 
CBI BOW 001 160812 45 13579 81754 63746 49393 34151 | 19255 06040 
CBI BOW 003 190825 63 13579 09277 01671 13900 55676 | 98488 24012 
CBA BOW 001 220815 78 13579 858356 16035 63707 34246 | 66010 47101 
CBI BOW 004 230837 72 13579 81942 95559 61989 41553 | 46767 83744 
CBI BOW 001 270802 59 13579 94482 55379 77472 58894 | 68471 04047 


After some experimentation with differencing various groups, we arrive at subtracting A5 from A2, 
yielding the results shown in Fig. 168a, below. Interesting properties are uncovered, but the backward 
progression of the groups as deciphered does not please us, so we subtract A2 from A5, as shown in Fig. 
1686. We now have serial indicators in the last three deciphered digits (except for apparently two missed 
messages), but there is something wrong with the initial dinomes. If we now take vertical differences of 
the consecutive initial dinomes, we observe that the differences (2, 1, 3, 4, 5, 3, 3, 1, 4) correspond exactly 
with the vertical differences on the consecutive file dates, if the differencing is done with borrowing sub- 
traction instead of the more usua] mod-10 arithmetic; we therefore subtract the dates from the (A5—A2) 
groups, yielding the plaintext indicators as shown in Fig. 168c. This means that the cryptographer’s 


3 Perhaps the underlying text is 5-digit code with a severe limitation in the a position. 
6 This could be the result of an underlying 5-digit code wherein the b digits of all the groups have the same parity, 
all odd or all even. 
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method of encryption was first to add the two digits of the date (with carrying addition) to the ab posi- 
tions of the plaintext indicator, and then use the A2 group as an additive (mod 10) for the modified 
indicator, burying the enciphered indicator in the A5 position. 




















A2 A5 A2-A5 A2 A5 A5-A2 Date A5-A2 Ind. 
59361 87762 '72609 59361 87762 38401 ol 38401 37401 
03530 43932 60608 03530 43932 40402 03 40402 37402 
13891 54294 69607 13891 54294 41403 04 41403 37403 
55748 99143 66605 55748 99143 44405 07 44405 37405 
53311 91717 62604 53311 91717 48406 11 48406 37406 
81754 34151 57603 81754 34151 53407 16 53407 37407 
09277 55676 54601 09277 55676 56409 19 56409 37409 
85836 34246 51690 85836 34246 59410 22 59410 37410 
81942 41353 40699 81942 41353 60411 25 60411 37411 
94482 58894 46698 94482 58894 64412 27 64412 37412 

Fiaure 168a Figure 168) Figure 168c 


g. Before leaving the subject of indicators there are still a few points that should be brought out; 
these are Jisted below. 

(1) As already shown, indicators may be in the clear, or they may be enciphered. An indicator may be 
inserted in the message preamble, or it may be derived by selecting certain elements of the preamble. 
In some systems the indicator may be either the page, row, and column of the additive book, or it may be 
one of the actual key groups on a page of key. If it is the latter case the quoted key may be the one used 
to encipher the first group of the message, or it may be the one immediately preceding the key group used 
to begin the text encryption. 

(2) In the preceding examples the discriminants were shown in the clear as the Al group, but there 
is no reason why they cannot be enciphered and for that matter also hidden among the text groups (as 
indeed has occurred operationally). The remarks on indicator encryption and on floating indicators 
apply equally well to discriminants. The discriminant may not necessarily be an entire group: it could 
be part of a group, even a single character. 

(3) Whether indicators are in the clear or are enciphered, sometimes a single indicator suffices. 
But more often, indicators (either in the clear or enciphered) are repeated as a check. For example, when 
the A2 is consistently repeated as the ZO, this is most probably an indicator (unless it is a control group 
as discussed below). Sometimes the indicator is confirmed by a check indicator; for example, the check 
indicator being such that the mod-10 sum of the indicator and its check is 0 O O O QO, or the five 
digits of the check indicator comprise the sums ab, bc, cd, de and ea of the indicator digits. Cryptographers 
usually prefer to vary the appearance of the plaintext check indicator when it is enciphered, as has been 
shown in some of our examples. 

(4) Discriminant (and also indicator) encipherment is sometimes governed by control elements in 
the message text or preamble, or both; these elements are not the actual key elements, but rather desig- 
nate where the actual keys (from a separate list) may be found. The control elements might be found in 
an individual group, or they can be scattered. For example, the units digit of the group count in con- 
junction with the a element of the A3 group might designate the page of a 100-page key book to be 
consulted, and the de elements of the A3 might designate the row-column position of the key group 
which is to be used to encrypt the discriminant or indicator. In analysis, messages with hitting groups 
in the suspected discriminant position are examined, to determine which textual or preamble elements 
also hit consistently and thus point to the control elements involved. In the sets of message beginnings 
below, in which there are hits in the Al group (the suspected position of a discriminant), it is apparent 
that the only consistent control for the discriminant encipherment must be the units digit of the group 
count, the c position of the A4 group, the d position of Z1, and the e position of ZO. (The last set, which 
is in apparent conflict with our findings, must involve a noncausal repetition of the Al group.) 
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TVJ UHW 225 171526 93 53464 25338 24300 35987 64073 73964 73262 


IGR BIU 618 131014 57 64291 92726 04269 82279 67823 54781 63600 
IFZ LPT 924 240819 47 64291 21641 21992 45263 15030 24618 29740 
MOJ SWT 036 291650 87 64291 74983 85054 94288 58692 64956 90970 


KUD RYU 492 161055 46 67629 21079 75093 02955 32116 53449 87202 
NBW CMV 578 180918 43 67629 25596 02364 80665 49911 98818 34797 


(5) There are cases in which no discriminant is used, the appearance of the text being sufficient to 
denote the system; e.g., where a single unenciphered code system is being used, or a transposition system, 
or a bipartite system with self-evident row- and column coordinates. In these cases the only indicator 
will be a message indicator, if one is necessary. 

(6) There have been instances when the key in certain low-grade systems was determined by the 
units digit of the group count (thus amounting to a single indicator digit), continuing in either an ascend- 
ing or descending numerical sequence to produce a 10-digit cyclic key. In other instances the units digit 
(n) of the group count was the first key digit, the second key digit was (n+1), and thereafter the key 
was derived from the initial dinome by Fibonacci treatment, i.e., a+ b=c, b++c=d, etc. Thus if the 
units digit of the group count were 2, the starting dinome would be 23, and the resulting Fibonacci se- 
quence would be 2358314594 . . . which has a cycle of 60. (Other Fibonacci cycles, wherein a+b=c, 
have lengths of 20, 12, 4, 3, and the trivial length 1.) Additive keys for low-grade systems have sometimes 
also been taken from several elements appearing in the preamble of the messages. For example, the file 
date and time could constitute a 6-digit cyclic key; or the file date/time reversed plus the group count 
and the mod-10 sum of the latter could constitute a 9-digit additive key. 

(7) In the study of indicator usage the analyst should be on the lookout for evidence both of tailing 
and trailing,” not only on the basis of a chart as exemplified earlier, but also on the basis of the sequence 
of settings of various machine cryptosystems with which he is familiar. (As a parenthetical aside, although 
one-time-pad systems are wont to have tailing indicators, the assumption of a one-time-pad system is the 
last assumption an analyst should make about an unknown cryptosystem; after all, the keys may be used 
serially, and then re-used from the beginning again. There have been tuo many cases of traffic put aside 
under the label of ‘‘one-time-pad system” that was subsequently solved as some other type of system.) 

(8) It is important to examine indicators of sequential messages, whether these indicators are in the 
clear, or enciphered, or decrypted, because sometimes the indicators may be related in some fashion 
from message to message. As an elementary example, let us suppose that we have intercepted a string 
of five messages from one originator, as shown in the log extract below: 


To From NR. _FDT GR Al _A2 AS A4 AS | Zl _ZO 

GJB YPO 314 281142 63 56156 86175 75356 63698 07426 | 54252 93651 
GJB YPO 315 281159 42 56156 47823 78625 51818 41757 | 46728 29160 
GJB YPO 316 281220 49 56156 15057 90977 77279 38000 | 81647 10762 
GJB YPO 317 281312 55 56156 65528 06001 61452 49192 | 17321 17383 
GJB YPO 318 281336 50 56156 10704 72147 72350 14144 | 19735 80114 





17 It might be well to define these two terms as given in the Basie Cryptologic Glossary: 

“tailing, n. The practice of beginning the encipherment of one message with the elements of key immediately fol- 
lowing those used to encipher the last textual element of the preceding message; equivalent in a machine cipher to starting 
the second message at the position reached by the machine on completion of the first.” 

“trailing, n. The practice of beginning the encipherment of one message with elements of key at a comparatively short 
interval after those used to encipher the last textual element of the preceding message; equivalent in a machine cipher 
to starting the second message at a machine position a few steps after that reached by the machine on completion of the 
first message.”’ 
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The phenomena present in the A2 indicator groups make it possible to predict the indicators for succeed- 
ing messages, after it is noted that the Fibonacci addition of a + b, b+ c,c + d,d +e, ande + aof 
the digits of one indicator form the digits of the indicator for the next message. In another example, we 
have a log extract of five sequential messages that have been intercepted: 


To From NR__FDT GR_Al _A2 _A3_ _A4 __AS Zl -_-z0 
WHM PJY 428 051600 55 77788 86173 68548 16136 11573 | 52552 44611 
WHM PJY 429 051623 58 77788 57492 13347 57418 49468 | 43852 60739 
WHM PJY 430 051635 47 77788 33565 33239 07394 14333 | 45477 66794 
WHM PJY 431 051655 73 77788 80957 62416 86251 89835 | 69485 43263 


WHM PJY 432 051702 52 77788 13412 56209 92192 22184 | 27255 69611 


In this example, the Fibonacci treatment has been applied vertically between messages in the column of 
A2 indicator groups, so that it becomes possible to predict the indicators for succeeding messages.'® 

(9) As a final note of caution on indicators, the number of possible different indicators in a particular 
indicator system does not necessarily reflect the number of possible distinctly different effective indi- 
cators. In an example given earlier, the first letters of the 5-letter groups were limited to the A—-E range, 
the second letters to those in the F-K range, and the third letters to those in the L-R range (the last 
two letters appeared as a constant digraph, therefore possess no information value). The number of 
possible indicators is then 5X67 or 210; this number is either the total number of keys, or the total 
number of starting points in the key, or a lesser number of either, if variants happen to be involved; 
for all we know, if A and E are variants, as are also F/J, G/K, L/P, M/Q, and N/R, the number of distinct 
indicators is reduced to 4X44 or 64. 

h. Having treated the diagnostics of message length characteristics and indicators, we shall now 
take up the manipulation of message texts. Both individual messages and sets of messages are subjected 
to study, in a manner calculated to make latent phenomena patent through manipulative processes 
(or, for that matter, to make patent phenomena more obvious). Depending on the volume of traffic at 
hand, we segregate messages by visible characteristics such as indicators, or we segregate messages sent 
within a relatively narrow time span; we compare messages sent by the same originator; or we compare 
those sent on the same day of the week (to uncover possible weekly re-use of keys), or on the same day 
of the month (to uncover possible monthly key rotas). As mentioned before, any phenomena uncovered 
may suggest subsequent steps to be taken. At this stage, the pertinency and utility of logging methods 
may be decisive. The manner of preparing worksheets and of summarizing statistical data play an im- 
portant part in the timely solution of a cryptosystem. Sometimes the particular order of procedures 
and tests makes little difference, and at other times the order is of considerable importance. 

a. In all of one’s endeavors, the successful cryptanalyst’s precept should be kept foremost in mind: 
“Try the simplest thing first.” It is surprising how often this admonishment is disregarded, to the later 
chagrin of the cryptosinner. The comments by I. J. Good under the topic “rational behavior” are par- 
ticularly germane to this discussion: ® 


“The principle of rational behavior is to maximize ‘expected utility’ per unit time. An 
example is that some experiments are worth performing mainly because they are quick and 
easy. The reasons are: (a) being quick, the ‘expectation’ of (value of the test) -+ (time expended) 
is liable to be large because the denominator is small; (b) being easy, the hypothesis behind the 
experiment is usually simple and therefore has a nonnegiligible initial probability of being true; 
(c) if easy things were not the most important, human beings would already be extinct. 

“If of two hypotheses that are equally easy to test, one is much more useful if true, it 
may be more worth testing than the other, even if much less probable. This principle is perhaps 
more important in cryptanalysis than in other branches of science. Its relevance is sometimes 
obscured by the use of expressions such as ‘I don’t like this hypothesis,’ which ought to mean 
‘I don’t think its expected utility per unit testing time is large,’ but is liable to mean ‘I think 
its probability is low.’ ” 


18 The observant reader might note that the ZO group in the two examples above is an indicator check ; let him uncover 
the procedures involved. 
'9 Standard Reagents and Diagnostician's Dictionary (p. 2), National Security Agency, 1966. 
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. Taking a case in point, the process of completing the plain-component sequence using standard alphabets 
is net very likely to bear fruit in an operational problem; but when it does, it’s marvelous. There isn’t 
' much effort involved in the procedure (especially if we possess already prepared alphabet strips), and 
the time it takes is very small compared with many other aspects of cryptanalysis. To illustrate the 
value of trying the process anyway, let us suppose that we have some traffic in an unknown cryptosystem, 
the messages being sent in 5-letter groups except for the Al which is always a 5-digit number. No 
unusual statistical properties, repetitions, or other phenomena have been observed, and we might even 
suspect a high-grade system to be involved (if we know nothing about the cryptographic history of the 
target country). Nevertheless, if we try completing the plain-component sequence on the basis of direct 
standard alphabets, we would obtain a solution, as shown below for one of the message beginnings 
(the Al here was 26996): 




















C: USVIQJOZYFQEGNODAKIFEHAYYKNZKD 
VTWJIRKPAZGRFHOPEBLJGFIBZZLOALE 
WUXKSLQBAHSGIPQFCMKHGJCAAMPBMF 
XVYLTMRCBITHJQRGDNLIHKDBBNQCNG 
YWZMUNSDCJUIKRSHEOMJILECCORDOH 
ZXANVOTEDKVJLSTIFPNKJMFDDPSEPI 
AYBOWPUFELWKMTUJGQOLKNGEEQTFQJ 
BZCPXQVGFMXLNUVKHRPMLOHFFRUGRK 
CADQYRWHGNYMOVWLISQNMPIGGSVHSL 
DBERZSXIHOZNPWXMJTRONQJHHTWITM 
ECFSATYJIPAOQXYNKUSPORKIIUXJUN 
FDGTBUZKJQBPRYZOLVTQPSLJJVYKVO 
GEHUCVALKRCQSZAPMWURQTMKKWZLWP 
HFIVDWBMLSDRTABQNXVSRUNLLXAMXQ 
IGJWEXCNMTESUBCROYWTSVOMMYBNYR 
JHKXFYDONUFTVCDSPZXUTWPNNZCOZS 
KILYGZEPOVGUWDETQAYVUXQOOQADPAT 
LJUMZHAFQPWHVXEFURBZWVYRPPBEQBU 
MKNAIBGRQXIWYFGVSCAXWZSQQCFRCV 
NLOBJCHSRYJXZGHWTDBYXATRRDGSDW 
OMPCKDITSZKYAHIXUECZYBUSSEHTEX 
PNQDLEJUTALZBIJYVFDAZCVTTFIUFY 
QOREMFKVUBMACJUKZWGEBADWUUGJIVGZ 
RPSFNGLWVCNBDKLAXHFCBEXVVHKWHA 
SQTGOHMXWDOCELMBYIGDCFYWWILXIB 
TRUHPINYXEPDFMNCZJHEDGZXXJIMYJC 








It can be seen that the encipherment is effected three letters at a time with a particular key letter, and 
the shifting of the components is apparently never greater than 9 positions. Knowing the mechanics 
of the system, we can nowread all messages with comparative ease, even though the meaning of the Al 
might not be understood for some time.”° The chances of solving such a system by any other means 
are rather slim, yet the simplest technique of all gives a quick—and effortless—answer. 


20 The method of key generation is as follows: Each correspondent has a secret fixed key which is used as a subtractor 
to encipher a randomly chosen plaintext indicator, and the enciphered form is sent as the Al group of the message. The 
plaintext indicator consists of a 5-digit group wherein the e digit, as a safety factor, is the noncarrying sum of the first 
four digits; this indicator is then used as a priming key to generate a Fibonacci sequence by the formula a + b=f. Thus, 
in the example above, the secret key 12345 is added to the Al group (26996) to yield the plaintext indicator 38231, 
from which is generated the sequence 105421596364599. . . This sequence (omitting any zeroes that might occur 
in order to avoid enciphering more than three letters at one setting) is then used, starting with the initial alignment of 
the components at A,=A,, to give the successive displacements 1542159636 which will read the first 30 letters of the 
message. 
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j. In the manipulation of message texts we perform essentially only a few basic processes, those 
necessary to reveal hoped-for phenomena, just as the physician begins his first examination by looking 
at the patient’s tongue, taking his temperature, and tapping his knee with his little hammer—all this 
in the hope of disclosing something untoward. The cryptanalyst’s manipulation entails the manner of 
recording original and derived data, writing and rewriting data in various forms and formats most 
suitable for the particular purpose or study, and the transformation or reduction of data. Initially, the 
manipulation and examination is done by hand, at least for a few messages—there still is no computer 
equal to the human brain—while waiting for the results of machine examination to come back. We 
proceed with machine processing (a) if nothing of interest turns up, (b) if what turns up cannot be 
interpreted, and (c) if examining a volume of traffic. Emphasis on the initial importance of looking at 
the material does not belittle machine techniques, which are valuable and often essential; it is rather a 
plea not to use machine techniques too early, for the vital clue may not respond to any of the mechanized 
tests, even with a very large library of routines. 

k. The cryptanalyst takes various kinds of frequency counts in the hope of disclosing a significant 
roughness which is then mash for his still; he indexes groups in the search for polygraphic repetitions; 
he examines patterns in the search for isomorphs; he writes out the texts and other data in various 
formats; he superimposes and compares messages, looking for an excess hit rate or other phenomena of 
significance; he derives secondary data such as differences, delta streams, or parity streams; and he 
compares sets of original and derived data. In the manipulative stage, much depends upon the crypt- 
analyst’s experience and ingenuity if he is to avoid unnecessary work and achieve his results economically. 
We shall now give examples to illustrate these various points in as general a context as possible in order 
to show that their application is universal, whether manual or machine cryptosystems are involved, 
or whether the examination is performed by manual or machine methods. 

l. We shall use as our first example the 200-letter message below, with which a number of points 
can be illustrated: 


PYLPP NAFTH TKSSF ZPMYX XXJIJNU MHKZK 
RUHBS QIEBS FMVWC FYDTF DFIJB YAQDX 
XOJOC NXWNN PRUJS JIHHW BNPVB VCGKY 
HSTZV YCFYD VNEUM 000ZG BUZPI YMHHJ 
WDZDU CCEFN QIKGF NGCSJ UQUKT VXRDQ 
YYMTM ZRUCW FIHYL EGGGA XKLFZ ZQTOQ 
GTRYT ZYBRX DZIGM SOMLY 


A cursory examination shows a rather high doublet rate of 15 when we expect 7.7, but when this is eval- 
uated it turns out to be a deviation of 2.60, enough to be interesting, but not enough to be exciting.”! 
We have not forgotten so soon the admonishment contained in subpar. 7, above—standard alphabets 
just might be involved in some fashion or other; but the generatrices of this test show nothing. A uni- 
literal frequency distribution is taken, 


= Ss 2S Sek SSexee2 8 SSL sis 
B 2225S 2222225 22222 222222222 
ABCDEFGHIJKLMNOPQRS TUVWXYZ 


21 The calculation is performed as follows: the expected number of doublets in this sample is = or 7.7; the standard 


deviation may be taken as the square root of the expected number, which is ¥7.7=2.8; the excess doublets over the 
expected is 15.0—7.7=7.3; and the sigmage is obtained by dividing the standard deviation into the excess number, so 
7.3 


a7 2 5s. 
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which to the unpracticed eye might look ‘‘a little rough,” but the I.C. is actually lower (0.97) than the 
average expected for a random sample of this size.” In searching for polygraphic repetitions, we find 
just one repeated tetragraph, CYFD. In a sample of this size, the chance of a random tetragraphic repeti- 
tion is small; in fact, it may be shown that if we had 1000 samples of 200 letters each of random text, we 
would expect to find a repetition in only 43 of them.” The repetition CYFD is at an interval of 52, an 
interesting number to a cryptanalyst since it has a factor of 26. When the cryptogram is written out on a 
trial width of 26, the columnar ¢ values sum to 80 as shown in the diagram below: 


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
PYLPPNAFTHTKSSFZPMYXXXJINUM 
HKZKRUHBSQIEBSFMVWCFYDTFODF 
IJBYAQDXXOJOCNXWNNPRUJSJIUH 
HWBNPVBVCGKYHSTZVYCFYDVNEU 
MOOOZGBUZPIYMHHJWDZDUCCEFN 
QIKGFNGCSJUQUKTVXRDQYYMTMZ 
RUCWFIHYLEGGGAXKLFZZQTOQGT 
RYTZYBRXDZIGMSOMLY 

E422 - 42 42 2 - 6 42 1264 4 2 4 28 2 ~- 2 - - =80 
22 The delta I.C. is calculated by the formula any where c is the number of categories, Zf(f-1) is the observed 
value of ¢, and N is the sample size. The expected value of the 5I.C. for random is 1.0. In this example, 1 poe) 0.97. 


The 6 I.C. is the correct statistic to be used for samples from a population, since it compensates for sample size. 


Another statistic, the gamma (7) I.C., with the formula =e, is the measure of roughness to be used when we have the 
universe or total population of a particular case. 

23 The expected numbers of two-, three-, and fourfold occurrences of trigraphs, tetragraphs, and pentagraphs in 
26-category random text for samples up to 1000 letters are given in the following table: 











' No. of | Exp. no. of trigraphs Tetragraphs Penta. 
letters |} E(2) E(3) E(4) E(2) = E(3) E(2) 
100 0, 269 | 0. 001 0. 010 

200 1.10 | 0, 004 0. 043 0. 002 
300 2.48 ; 0.014 0. 096 0. 004 
400 4.40 | 0. 033 0. 171 0. 007 
500 6.85 | 0. 064 0. 270 0. 011 
600 9.81 | 0.111 | 0.001 || 0. 389 0. 015 
700 13. 3 0.175 | 0. 002 || 0. 530 0. 021 
800 17.3 0. 261 | 0.003 || 0. 693 0. 027 
900 21.8 0. 371 | 0.005 || 0. 877 0. 034 
1000 26. 8 0. 505 | 0. 008 || 1. 08 0. 001 || 0. 042 














Similarly, the expected numbers of two-, three-, and fourfold repetitions of trinomes, tetranomes, and pentanomes in 
10-category random text for samples up to 1000 digits are given in the following table: 














No. of | Exp. no. of trinomes Exp. tetranomes Pentanomes 
digits E(2) E(3) E(4) E(2) E(3) E(4) E(2) E(3) 
100 4, 49 0. 147 0. 004 0. 49 | 0. 002 0. 046 
200 16.3 1. 08 0. 053 1.95 | 0. 013 0. 199 
300 33. 3 3. 31 0. 246 4,35 | 0.043 0.001 || 0. 447 
400 53. 6 7.12 0. 707 7.67 | 0.102 0. 002 || 0. 795 
500 75.8 12. 6 1. 37 11.9 0.197 0. 002 1, 24 0. 002 
600 98. 8 19.7 2.95 16.9 0.337 0.005 || 1.79 0. 004 
700 122 28. 3 4, 94 22.8 0.531 0.009 || 2. 43 0. 006 
800 144 38. 3 7. 64 29. 5 0.785 0.016 |} 3.17 0. 008 
900 || 165 49. 4 11.1 37.0 1.11 0.025 || 4. 01 0. G12 
1000 || 184 61.3 15.3 45. 2 1.50 0.038 || 4.95 0. 017 
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Since there are 18 long columns (of 8 letters each) and 8 short columns (of 7 letters each), the I.C. of the 
26(80) 
18(8X7)+8(7X6) 
for a small sample) to 1.73 if the language of the underlying text is English. If the cryptogram is in 
a progressive alphabet system we can solve it by a statistical method™ with additional traffic, or we can 
even solve this single message if there are isomorphs present; if, however, it is in a different kind of 
system employing 26 alphabets, it will take more traffic to enable a classic solution by frequency analysis 

and the probable word method. 

m. Continuing with the analysis of the foregoing cryptogram, we conduct a search for possible 
isomorphs, using a simple method: each cipher letter is compared with, say the 5 letters following, and 
if there is a reoccurrence of that letter within that span, a numerical indication is placed under the re- 
occurrence of the letter equal to the interval of the monographic repetition. The cipher text of our example 
with the appropriate numerical indications is given below: 


text written on this width is = =1.55, interestingly close (an acceptable deviation 


PYLPP NAFTH TKSSF ZPMYX XXJNU MHKZK 
31 2 1 lil 2 
RUHBS QIEBS FMVWC FYDTF DFIJB YAQDX 
5 5 5 4 32 
XOJOC NXWNN PRUJS JIHHW BNPVB VCGKY 
1 2 31 2 1 4 2 
HSTZV YCFYD VNEUM 000Z2G BUZPI YMHHJ 
3 11 4 1 
WDZDU CCEFN QIKGF NGCSJ UQUKT VXRDQ 
2 1 3 2 
YYMTM ZRUCW FIHYL EGGGA XKLFZ ZQTOQ 
1 2 il 1 3 
GTRYT ZYBRX DZIGM SOMLY 
4 3 3 3 


The foregoing method insures the easy findings of the following sets of isomorphs: 


31 2 1 
(1) PYLPPNAFTHTKSS 
(2) NXWNNPRUJISJIHH 
(3) DZDUCC 
11 
(4) MYXXXJINUM 
(5) UMOOOZGBU 
(6) LEGGGAXKL 
2 1 2 
(7) FDFIJBYAQDXXOJO 
(8) UQUKTVXRDQYYMTM 


From these isomorphs the following partial chains may be derived: 


1-2: PNP YX LW AR FU TJ HSH KI 
1-3: TD HZ KU SC 

2-3: JD SZ IU HC 

4-5: YMUB XO JZ NG 

4-6: ML YE NXG JA UK 

5-6: UL ME OGX ZA BK 

7-8: FU DQD IK JT BV YXY AR OM 


4 Cf. par. 69 (pp. 161-169) of Military Crypianalytics, Pari I. 
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_ By using the principles of indirect symmetry of position,” we can amalgamate these chains and construct 
a sequence which, when decimated at the proper interval, will yield the QUESTIONABLY . . . XZ 

. keyword-mixed sequence, the original cipher component of the system. Having the cipher component at 
hand, we are now able to effect a reduction to monoalphabetic terms of the complex cipher text, if we know 
or can assume the motion of the cipher component; in the case of a progressive alphabet system, the 
motion is at a constant interval, either to the right or to the left. If we arbitrarily assume the normal 
sequence for the plain component, with the two components juxtaposed at the setting Ap=Q., and de- 
cipher the beginning of the cryptogram by moving the cipher component to the right after each decipher- 
ment, 























12 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
C: PYLPPNAFTHTKSSFZ2PMYXXXJINUM 
MPs UMMXYMOVMZODPQCOKKDRSTNEZS5B 
C: HKZKRUHBSQIEBSFMVWCFYDTFODF 
MPs QTBVZGWQLJIPNVQCIMOEHFIALLN 
C: IJBYAQDKXXOJOCNXWNNPRUJSJIH 
Up Ws FSLOMFTFGPBRYUMMXYMOVMZOODP 
the distribution of the resultant ‘‘plain text” 
z = 
ee ees Ole Go bc Pa Ra ee 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
ae 26 (252) a 
with its I.C.= 7877 = 1.09 is not satisfactory. But when we decipher the beginning of the cryptogram 
by moving the cipher component to the deft after each decipherment, 
12 3 4 5 6 7 8 9 10 1! 12 13 14 15 16 17 18 19 2 21 22 23 % 25 26 
C: PYLPPNAFTHTKSSFZPMYXXXJINUM 
MPM; UKTRQCCHWHUHRQAKECTFEDVKDU 
C: HKZKRUHBSQIEBSFMVWCFYDTFODF 
i QRXPRWKCVRVRXQAEGGUVRSIRPP 
C: IJBYAQDXXOJOCNXWNNPRUJISJIH 
Mpls FQHIEVHRQXHVAUKIRQCCHWHUUHR 
the distribution of this ‘plain text” 
~ = sz ~~ 
= 22 Ss 28 z B22... 2 258 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
ree : 26 (388) : ; . ae oh 
with its LL.C.= 7X 77. 1-68 shows that this converted text has been reduced to a simple substitution 
which we can now readily solve, discovering in the process that the plain component is the HYDRAU— 
LIC . . . XZ keyword-mixed sequence. 


n. There are certain situations, rarely predictable in advance, wherein it is profitable (nay, even 
mandatory) to derive a delta stream of the cipher text, typically by differencing the first element of 
text from the second, the second from the third, and so on, on a known or assumed modulus or scale. 
The value of this technique will be apparent in the examples which follow. 

(1) For the first example, we shall assume that we are in possession of a small volume of traffic sent 
in 5-letter groups in an unknown cryptosystem. The over-all I.C. of the traffic is close to 1.0, as are the 
I.C.’s of the individual messages. A few polygraphic repetitions, both within and between messages, are 
in evidence, more than expected at random; the intervals between the repetitions have no common factor, 
but the closest ones are at an average of approximately 22 letters apart, and then at an average of approxi- 


28 Cf. Chapter V1, Miltlary Cryplanalylics, Part I]. 
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mately 45 letters apart. No evidence of depth exists between messages, although a higher-than-expected 
hit rate for random is observed in the first 5-6 letters or so between messages that contain common 
polygraphic repetitions within the body of the messages. A typical message with its distribution is given 


below: 
DLHGI HXNYT VPIZM BIFCS HTKXM THKCS 
LecxZ XDSOX GFIOJ LFYAK ZMUXT HJIZTB 
UMZEL CLKSI TOQKT RXMIA XNCLL GTZDL 
MBJAC TAGIF RIXWV GBASF FFYOI AZZCC 
XFXHC WFEHN IKEXZ WYYAF SXOPA VUMZZ 
ZSICU JSTPI OMEUR NTHHH WEDGE QUSNZ 
FNBBO TARAZ LNKMF CBURR 
Z= ZF .~2L_2F LSBs ~ 3 Zs =z =z 
Z2ZZSBZRP~PBAZASBZWZBZAZSr~ ZZZWZSTBEZZZ 
ABCDEFGHIJKLMNOPQRSTUVWXY2Z 
26(1646) 


Neither the appearance of the cipher text, nor the I.C. of 2001997 1-075 shows much promise for 


immediate attack. But look what happens when we take a delta of the cipher text, using the normal A-Z 
sequence as the modulus: 























DLHGI HXNYT VPIZM BIFCS HTKXM THKCS 
HVYB YPPKU BTSQM OGWWP OLQMO GNCRP 
LCOCXZ XDSOX GFIOJ LFYAX ZMUXT HJZTB 
SQZUB XFOVI IYCFU BTSBW BMHCV NBPTH 
UMZEL CLKSI TOQKT RXMIA XNCLL GTZDL 
SRMEG QIYHP KUBTI XFOVR WPOIZ UMFDH 
MBJAC TAGIF RIXWV GBASF FFYOI AZZCC 
AOHQB QGFBW LQOYY KUYRM ZZSPT RYZCZ, 
XFXHC WFEHN IKEXZ WYYAF SXOPA VUMZZ 
KUHRJU TIYCF UBTSB WBZBE MEQAK UYRMZ_), 
ZSICU JSTPI OMEUR NTHHH WEDGE QUSNZ 
~ZSPTR OLAVS FXRPW VFNZZ OHYCX LDXUL 
FNBBO TARAZ LNKMF CBURR 
FHNZM EGQIY LBWBS WYSWZ 





A plethora of repetitions is manifested, proving conclusively (1) that, unbeknown to us, the normal 
sequence was somehow involved, and (2) that it was a lucky thing indeed that we had decided to take a 
delta stream of the cipher text. The many latent isomorphs in the text were too short to permit their 
recognition, except for the two sets, now in retrospect, of the longer isomorphs. 

(2) The appearance of the polygraphic repetitions in the first line of the delta stream and their 
‘fnterruption” by one letter suggests (1) that spelled-out numbers are probably in the underlying plain 
text, and (2) that the encipherment probably involves word lengths. If this latter premise is true, the 
li-letter delta repetition indicated in the fourth pair of rows must reflect a 12-letter plaintext word. 
In trying various possible cribs, notice what happens when we test HEADQUARTERS in this position: 


HEADQUARTERS 
VGBASFFFYOIA 


Equivalents of E,: G(h i j k 1 mn)jOo 
Equivalents of A,: Bic d e)F 
Equivalents of R,: F(g h)I 
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Not only is there corroboration for the assumption of HEADQUARTERS, but the spacing of the cipher 
equivalents for the repeated plaintext letters along a distance measured on the normal sequence proves 
that there is a constant motion of one step of the cipher component during the encryption of a word. 
This leads easily to the recognition of the numbers SEVEN, EIGHT, and THREE in the text; the threefold 
occurrence of the word STOP; and, in the second pair of lines, the cipher text XGFIOJLF is identified as 
the word DECEMBER from the pattern of the possible equivalents for a repeated letter (E,): 


DECEMBER 
XGFIOJLF 
G(h)I(j k)L 


The message is now on the way to solution: when solved, the beginning is found to read “REURAD NUMBER 
SEVEN FIVE SEVEN DATED ONE EIGHT DECEMBER STOP . . .’’; the plain component is found to be 
the HYDRAULIC . . . XZ keyword-mixed sequence; and the cryptosystem is determined to be a 
modified progressive alphabet system in which the normal-sequence cipher component moves one step 
after the encipherment of each letter, with a double step at the end of each word. 

(3) For the second example of the delta technique, let us assume that we are faced with traffic in 
an unknown cryptosystem, but that historical precedent indicates the possibility of cyclic repeating keys. 
The messages are transmitted in groupings of five dinomes. A typical message, with its associated fre- 
quency distribution, is the following: 


41 70 19 05.97 76 72 58 O7 21 11 O7 54 46 74 O7 40 57 35 56 
20 13 07 8118 44 07 02 56 91 38 22 17 43 57 41 98 34 79 29 
76 44 97 96 03 81 06 86 71 68 8813 16 47 46 13 51 78 29 13 
34 05 42 65 56 55 14 72 46 25 81 21 44 11 61 85 16 16 42 65 
52 44 41 08 59 26 14 00 90 07 30 16 28 09 43 51 30 89 12 23 
82 06 32 39 09 49 25 98 15 22 88 33 26 65 64 42 46 76 53 53 
28 28 33.17 32 41 36 96 20 01 41 87 72 60 16 31 65 28 39 74 
49 68 51 99 72 24 55 63 16 86 33 37 42 82 27 58 28 70 98 10 
14 48 31 90 72 78 61 19 67 22 92 26 44 37 29 


00 1/101] 20 2 | 30 2; 40 1 | 50 60 1 | 70 2 | 80 09 2 
O11 ]11 2] 21 2) 312/415) 51 3) 612) 711! 81 3/911 
021/121 | 22 3! 322)424 ee 725/822 )921 
03 1] 13 4] 23 1 | 33 3 | 43 2! 53 2 | 62 1 | 73 83 93 

04 14 3 | 241 | 384 2 | 44 5) 541 | 641 | 74 2 | 8&4 94 

05 2/151) 25 2 | 35 1 | 45 | 55 2 | 65 4 | 75 85 1 | 95 

06 2 | 16 6 | 26 3 | 361 | 46 4: 56 3 | 66 76 3 | 86 2 | 96 2 
07 6 | 17 2 | 27 1 | 87 2 | 47 1 | 57 2 67.1) 77 87 1 | 97 2 
08 1; 18 1 | 28 5 | 38 1 | 48 1 | 58 2} 68 2 | 78 2 | 88 2 | 98 8 
09 2 | 19 2 | 29 3 | 39 2 | 49 2 | 59 1 | 69 | 791 89 1| 99 1 

Th 100(312) _ . 4 Be ie c wis sez : 
e LC. of i75x1747 1.025 is not informative; there are no polygraphic repetitions of significance; and 


writing the text on widths has produced nothing of consequence. We sha!) now try deriving delta streams; 
first, a delta at an interval of one dinome (with mod 10 arithmetic): 


C: 41°70 19 05 97 76 72 58 O07 21 11 O07 54 46 74 O7 40 57 35 56. 
A: 39 49 96 92 89 06 86 59 24 90 96 57 92 38 33 43 17 88 21 


The entire delta stream at this interval reveals nothing of interest, so we next take a delta stream at 
an interval of two dinomes, deriving the following A, stream: 


C: 41 70 19 05 97 76 72 58 07 21 11 O07 54 46 74 O7 40 57 35 56 . 
A! 78 35 88 71 85 82 35 73 14 86 43 49 20 61 76 50 95 09 
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This stream too shows nothing; but when we finally take a Ay, we obtain the following: 


C: 4170 19 05 97 76 72 58 07 21 11 07 54 


Ay? 

C: 2013 
Anes, 25 92 
C: 76 44 
An: 20 53 
C: 34 05 
Aw: 63 47 
C: 52 44 
Aw: 16 29 
C: 82 06 
42. 92 09 
C: 28 28 
Ay: 13 06 
C: 49 68 
Aw: 29 67 
C: 14 48 
Ar: 08 62 


O07 
96 


O97 
69 


AR 
64 


41 
60 


32 
02 


33 
55 


51 
10 


31 
08 


81 
84 


96 
74 


65 
52 


08 
87 


39 
25 


17 
84 


99 
12 


90 
63 


18 
64 


03 
96 


56 
40 


59 
15 


09 
81 


32 
16 


72 
00 


72 
30 


44 


08. 


81 
48 


55 
18 


26 
15 


49 
40 


41 
86 


24 
64 


78 
96 


O7 
33 


06 
59 


14 
78 


14 
53 


25 
82 


36 
Te 


55 
49 


61 
44 


02 
05 


86 
45 


72 
69 


00 
295 


98 
47 


96 
54 


63 
32 


19 
61 


56 
16 


71 
83 


46 
95 


90 
84 


15 
85 


20 
84 


16 
51 


67 
49 


91 
44 


68 
34 


25 
57 


07 
91 


22 
43 


01 
35 


86 
68 


22 
52 


38 
03 


88 
19 


81 
62 


30 
98 


88 
76 


4l 
98 


33 
04 


92 
04 


22 
76 


13 
94 


21 
18 


16 
51 


33 
10 


87 
34 


37 
63 


26 
16 


13 


17 
O7 


16 
40 


44 
10 


28 
76 


26 
44 


Te 
54 


42 
03 


44 
30 


46 74 O07 AO 57 35 56 


76 65 02 53 81 635 08 


43 
30 


AT 
03 


11 
16 


09 
65 


65 
69 


60 
42 


82 
24 


37 
99 


57 
50 


46 
59 


61 
29 


43 
02 


64 
32 


16 
83 


27 
76 


29 
98 


41 
60 


13 
RT 


85 
20 


51 
53 


42 
13 


31 
24 


58 
69 


98 
80 


51 
58 


16 
60 


30 
81 


46 
AT 


65 
33 


28 
56 


34 
90 


78 
97 


16 
61 


89 
63 


76 
37 


28 
87 


70 
56 


79 
72 


29 
25 


42 
38 


12 
08 


53 
38 


39 
03 


98 
43 


29 
et 


13 
37 


65 
93 


23 
23_, 


53 
65 


74 
88 


10 
57 


The 9-dinome repetition revealed in the A, stream is proof (1) that there is a 21-dinome identical under- 
lying plaintext passage at the positions indicated by the two occurrences of the repetition, and (2) that, 
if this be a system involving a cyclic repeating numerical key, the length of this key is 12 dinomes.™ 


26 Note that the period here could not have been revealed by any other means, say writing the cipher text on this 
width—the underlying text is not rough enough to yield a significant I.C. on the correct width. 
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The solution from here on is straightforward,”’ based on the reduction of the periodic cryptogram to 
monoalphabetic terms. For example, if in the fragment of the worksheet below, the cipher dinome 46 
at position B2 is assumed to be (arbitrarily) 00,, then the cipher dinome 28 at position H9 must also 
represent 00,, since the delta repetition has already proved the location of the identical underlying 
plain text. The deriviation of the additives from these decipherments enables the recovery of other 
plaintext dinomes, finally culminating in the recovery of the entire 12-dinome keying sequence (to a 
relative base) and the reduction of the cipher text to monoalphabetic terms. (The completion of the 
solution of this problem, including the recovery of the plain text, is left to the interested reader.) 
1 2 38 4 5 6 7 8 9 © Ww 


K: 46 28 
A. (C) 41 70 19 05 97 76 72 58 O7 21 11 07 





(P) 


B. (C) 54 46 74 07 40 57 35 56 20 13 07 81 
(A) 13 76 65 02 53 81 63 08 23 9b 96 84 


(P) 00 
* * * * * 

G. (C) 44 11 61 85 16 16 42 65 52 44 41 08 

(A) 10 16 29 20 60 61 38 93 16 = 60 87 


(P) 





H. (C) 59 26 14 00 90 07 30 16 28 09 43 51 
(A) 15 15 53 25 84 91 98 51 76 65 02 53_, 
(P) 00 


I. (C) 30 89 12 23 82 06 32 39 09 49 25 98 
(A) 81 63_08 23 92 09 02 23 81 40 82 47 
P 
( * * * * * 

0. (C) | 67 22 92 26 44 37 29 
(A) | 49 52 04 16 30 99 98 
(P) 


(4) Related to the process of the derivation of delta streams is the process of autokeying, which 
may uncover phenomena when this principle has been incorporated i in the cryptosystem. Taking as an 
illustration the message beginning below, 


3667 8406 8424 5012 4749 1868 9463 S3l22 2118 9456 .. ., 


if we perform a ciphertezt autokeying decipherment, the key is actually at hand, since it is the cipher 
text itself, but it must be displaced against itself at an interval corresponding to the length of the in- 
troductory key. Under the assumption of an introductory key of one digit, the matched cipher, key, 
and resultant plain text are shown below: 


K: 566 7840 6842 4501 2474 9186 8946 3312 2211 8945 
C: 3667 8406 8424 5012 4749 1868 9463 3122 2118 9456 . 
P: -301 1666 2682 1511 2375 2782 1527 0810 0907 1511 


It is obvious that the unknown intermediate text is 4-digit code, with a limitation of 0, 1, and 2 in the 
first position of code groups. Although the foregoing example with an introductory key of one digit is a 
trival case of ciphertext autokey, an initial key of unknown length would not pose any problems. Taking 
the case of the message beginning 


5442 7900 4372 1948 4469 0128 0539 8863 9783 4489... , 


7 Cf. subpars. 83g-j on pp. 230-235 of Military Cryptanalytics, Part IT. 
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all that would be required is to try various offsets of the cipher text against itself, and one of the decipher- 
ments would be the actual plain text (to true base, of course) ; this is shown in the diagram below: 


K(5): 344 2790 0437 2194 8446 9012 8053 9886 3978 
K(4): 3442 7900 4372 1948 4469 0128 0539 8863 9783 
K(3): 3 4427 9004 3721 9484 4690 1280 5398 8639 7834 
K(2): 34 4279 0043 7219 4844 6901 2805 3988 6397 8344 


K(1): _344 2790 0437 2194 8446 9012 8053 9886 3978 3448 


C: 3442 7900 4372 1948 4469 0128 0539 8863 9783 4489 . 


P(l): -~108 5210 4945 9854 6023 1116 2586 9087 6815 1041 
P(2): --18 3731 4339 4739 0625 4227 8734 5985 3496 6145 
P(3): --—-9 3583 5378 8227 5085 6538 9359 3575 1154 ‘7655 
P(4): --— 4568 7472 7676 3521 6769 0411 8334 1920 5706 
P(5): --—— -666 2682 1511 2375 2782 1527 0810 O907 1511 


On the.trial of an offset of 5, the underlying 4-digit plain code is revealed. (The missing first 5 digits would 
have to be determined by context after a volume of code text has been solved, or by analysis of the begin- 
nings of messages.) 

(5) In deriving a stream by the plaintext autokeying method, the “plain text’ resulting from a 
decipherment at the correct offset will either be the true plain, or one of 9 equivalent versions. For ex- 
ample, in the message beginning below, 


0331 2722 8840 3662 3502 7950 3679 7891 0997 8662 .. ., 


the decipherment at a one-digit offset is predicated on the supposed identity of the first plaintext digit. 
If we arbitrarily assume that the first plaintext digit is 3, we obtain the following decipherment: 


K: 303. 8439 3531 9424 8500 2541 9425 4354 7363 4424 
C: O331 2722 8840 3662 3502 7950 3679 7891 O997 8662 . 
P: 3038 43935 5319 4248 5002 5419 4254 3547 3654 4248 


(Note the trinomic repetition in the original cipher text, which becomes a tetranomic repetition when 
treated by the plaintext autokey method.) If we “complete the plain-component sequence’’ from this 
decipherment by going down the columns in alternate directions (down the normal numerical sequence 
in the odd columns, and down the reversed normal sequence in even columns), as shown in Fig. 169, 
below, we would recognize in the asterisked row the properties of code text having the limitation of 0, 
1, and 2 in the a position of the code groups. The foregoing case of plaintext autokey with a one-digit 
introductory key was quite simple; if the initial key were much longer, and the nature of the inter- 
mediate text unknown, the problem becomes exceedingly difficult—in fact, it is only fairly recently that 
a method of solution has been discovered.?® 


"PN; $058 4595 _ 5319 _4248 5002 5419 4254 3547__5634_4248 
3038 4393 5319 4248 5002 5419 4254 3547 3634 4248 
4947 5202 6228 5157 6911 6328 5163 4456 4543 5157 
5856 6111 7137 6066 7820 7237 6072 5365 5452 6066 
6765 7020 8046 7975 8739 8146 7981 6274 6361 7975 
7674 8939 9955 8884 9648 9055 8890 7183 7270 8884 
8583 9848 0864 9793 0557 0964 9709 8092 8189 9793 
9492 0757 1773 0602 1466 1873 0618 9901 9098 0602 

*0301 1666 2682 1511 2375 2782 1527 0810 0907 1511 
1210 2575 3591 2420 3284 3691 2436 1729 1816 2420 
2129 3484 4400 3339 4193 4500 3345 2638 2725 3339 


Ficure 169 


28 See Lambros D. Callimahos, ‘The Analysis of Digital Plaintext Autokey Systems,” appearing in the NSA Technical 
Journal, Vol. XIV, No. 2, Spring 1969. 
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. Second step: recognizing the phenomena.—da. 
preceding paragraph are undertaken in order to disclose nonrandom characteristics or manifestations. 
The second step in diagnosis is the recognition of the nonrandom characteristics or manifestations when 
disclosed. When, for example, we make a uniliteral frequency distribution of cipher text we are really 
hoping that some roughness or other property. will be manifested—otherwise we wouldn’t even have 
bothered to make the distribution. And after making the distribution, what’s the use of it if we don’t 
recognize the fact that it is rough? The recognition of phenomena, then, implies some sort of measure- 
ment, either by eye (relying on past experience and visua] memory), or by statistical means, which takes 
it out of the realm of the subjective. After finding a phenomenon—or what is thought to be a phe- 
nomenon—an evaluation should follow. It’s not enough to say “I think the doublets are high.”” How 
many are there? Count them. And, even more important, how many doublets are expected at random in a 


sample of this size? 
32 Note the repeating key, HEAVY WATER, manifested in one of the columns of Fig. 171. 


-18 USC 798 
-50 USC 3024 (i) 
-P 


b) (1) 
b) (3) 
b) (3) 
b) (3) -P.L. 86-36 
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b. Some phenomena cannot really be measured (or measured accurately) but permit of their recog- 
nition because of either past experience or intuitive feeling of something that’s “not quite right.’”’ For 
example, let us examine the following intercepted message and its frequency distribution: 


FOROF JIEOF KGMVQ IFORR IFRWM ASEFL QPOIE XCZIF ASDOF GHIRF 
QWERP PIFRI FORFO ASDIK JDGHJ ASPQE POIRP MNCCO ASDFK QPOIR 
OIKOP ASDEW UIOKP KOIJL POIEQ MNBVX IKFRI ROEWJ KIOLK LPOIU 
RETYU UINMH GHTYU IOKLP REDFS QAWSE DRFTG GYHUJ JIKOL ZSERD 
XDRTF QAWSZ RDXCF VGYUH NJIOK MLOKN LPOOP LKJHB FGJHK CVBNM 
QPWOL EORIK TIORI TUGJI TUHDG NJKHF LKOIL SEWDX QLASW NBJMB 


Ba TAI AY UIT 

"ZO TAU DAE DE PY 

G2 THI THY 

ol TAL AL 

FH PAY TY TAD DE PA TT 
THE DW III 

A TNE DY TAL Til 
TW PW III 
= PW III 

ZH Il 

© PHL DN THE DAL ONY TIT 
"UDA! DW TL 

© THI IN 

en 

C2 PAL IN IT 

Haw II 


S z 
ZzZZZ 
ABCD 


SI 
Sli 
SW Ii 


mS /iil 


Nii 


z 
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subjecting the cryptogram to close scrutiny, we find many points of considerable interest. For example, 
(1) we observe only 7 doublets and 6 A—A doublets when we expect 14.4 of each; (2) there are 7 tetra- 
graphic repetitions (IFOR, LPOI, OASD, POIR, QAWS, QPOI, UIOK) when we expect not quite a tenth (0.096) 
of one; (3) there are 23 trigraphic repetitions when we expect only 2.48; (4) on a width of 5, the average 
I.C. is 1.44, a deviation of 3.0c, and on a width of 15 the average I.C. is 1.52, a deviation of 2.50. We 
could find other statistical phenomena with which to build up an impressive case for some esoteric 


cryptosystem, the likes of which had not been seen by man before; but an experienced cryptanalyst 


The 6 I.C. here is 





= 1.256, which represents a sigmage of 10.850,” highly significant indeed. In 





% The standard deviation of the 6 I.C. is given by the formula oa V2 


= where c is the number of categories, and 
vN(N-1) 





N is the sample size. Thus, in this example, = 2D — 0236. The sigmage (S) is obtained by dividing the standard 
Vv 
eee if 3 : é—1.00 __.. . 0.256 . 
deviation into the “bulge” of the I.C., with the formula S= , so in this case S= 0236~ 10.850. The sigmage of the 


& I.C. is interpreted with the chi-square distribution; in this case, 10.850 may be found to represent about 1 chance in 
20,000,000,000 of having occurred at random. The table below gives the interpretation of sigmages from 1 to 5, accurding 
to the chi-square and Normal distributions, whichever is applicable in the particular case; the sigmage in the first column 
will be equaled or exceeded by pure chance, on the average, once every x times as shown in the table. 





Values of x 
Ss Chi-square Normal 
distribution distribution 
SS 
c=10 c= 26 
1 6. 6 6. 4 6.3 
1 12 13 15 
2 24 28 44 
2% 49 66 161 
3 102 164 740 
3% 220 435 4, 298 
4 483 1, 210 31, 500 
444 1080 3, 520 294, 000 
5 2470 10, 650 3, 488, 000 











SECRET 


(or a younger one who is destined to make his mark in the art) could, without too much difficulty, identify 
the cryptogram for what it is.** 

c. The importance of evaluating distributions and repetitive phenomena cannot be overstressed. 
Let us take as an example the case of 40 messages in a certain unknown system that was under study. 
The text groups, after the discriminants and indicators were deleted, totalled 9717 letters with the 
following distribution: 


A 356 G 403 L 361 Q 334 V 372 
B 347 H 398 M 381 R 395 W 306 
C 318 I 347 N 421 S 484 X 372 
D 369 J 325 0 401 T 409 Y 418 
E 386 K 379 P 313 U 359 Z 375 
F 388 


We have also observed 91 repeated tetragraphs and 5 repeated pentagraphs in the traffic, which strikes 
us as being probably considerably above the random expectations; there are no other longer repetitions. 

. 26(3,659,986) 
The 6 I.C. here is 07179716 
significance of the 6 I.C. is tied to the sample size, so we should go ahead and compute the sigmage. The 


-2(26-1) : . 7.0711 
—_————~—., which for all practical purposes becomes = 
9717x9716 B purp 9717 
.00073. Therefore the sigmage is a 10.8c—and we revise our estimate of the relative flatness of 


the distribution. As for the polygraphic repetitions, it would be wise to take a closer look at them. In 
arriving at the Poisson probability, we first compute a=Np (where N is the sample size and p is the 


=1.0079, certainly ‘‘flat-looking.” But we must not forget that the 


standard deviation for this example is 








probability of the item under investigation), so for tetragraphs at =.0213, rounded off to .02 for 
looking up in the tables, and for pentagraphs a= oe = 00082, rounded off to .001. Under the entry of 


a=.02 we find the probability of .0001960 for a two-fold occurrence (i.e., a repetition) of a tetragraph, 
and we multiply this probability by 26* to obtain the number of tetragraphs expected at random in a 
sample of this size; under the entry of a=.001 we find the probability of .0000005 for a repeated penta- 
graph, and we multiply this roa by 26° to obtain the number of pentagraphs expected at random. 


Our findings are summarized below: 
9717 : ao 
Tetragraphs: a= 26 =.0213 (=.02); Poisson probability =.0001960 





Expected at random =.0001960(26*) =89.6; observed =91 


% z 00082 (=.001); Poisson probability =.0000005 


Expected at random =.0000005(26°) =5.5; observed =5 


Pentagraphs: a= 





Random on the nose. Statistics ave useful. This means that, if the system is to be eventually solved, it 
will not be solved on the basis of its polygraphic repetitions. 

d. We have already stated, not in so many words, that the distribution of the 5 I.C. is asymptotic 
to the chi-square distribution with c-1 degrees of freedom; in plain English, this means that the distri- 
bution of the 6 I.C. is approximated (and thus may be interpreted) by the x? distribution. The ¢ I.C., 


34 A practice message, consisting of random typing of 5-letter groups on a typewriter. Note groups of the text, typical 
of typewriter random, composed of keyboard sequences and patterns (such as ASDFK, LPOIU, and QWERP, alternating 
hand patterns (such as FOROF, GHTYU, and QPWOL), and one-hand patterns (such as DRFTG, KIOLK, and REDFS). 
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however, is approximately Normally distributed, and thus has different formulas for standard deviation 
and sigmage, as shown below: * 
crf; f, 


(1) The €1.C. has the formula =~ >> NN, 


cross products of the corresponding sae, and N, and N, the sizes of the two See being 


> where c is the number of categories, Zf,f, the sum of the 





compared. If we recall the formula for the y I.C. (see footnote 22 on p. 345), wae a - Now if we com- 


pute the y I.C. for each of the two distributions being matched, the standard deviation of the & I.C. 
v(m— 1) a 1) 
c-l 
(€—1)Ve-1) 
V¥m—lDm—1) 


(2) As an example of the use of these formulas, let us take the ¢ I.C. of the following two distributions 


is given by the formula c= The sigmage of the é I.C. is then given by the formula 


si or, in another form, S= 











Sons 38 ~ 2s ~ is 2S's zz ~ 
1 ABCDEFGHIJKLMNOPQRS TUVWXYZ N=57 
SS SS So fe eS eS 
2. ABCDEFGHIJKLMNOP RS TUVWXYZ Neo5 
z9 1410 20 4160038 3 2t 1 3 12 12 4 10 42 =196 
The £ LO. here is 79099)_1.63. The y LC. of the first distribution (71) is ~719)-1.75; that of the 
second (y2) is 70039) =2.05; therefore the standard deviation of our é I.C. js HTL EO 00) 
(078) (1,08) — 08874 =.178. The sigmage of the ¢ I.C. ig STO 3.50. The evaluation of this 


sigmage follows ae Normal distribution, so that 3.50 represents 1 chance in 4298 of having occurred 
at random. 

e. Certain cryptosystems have characteristic uniliteral frequency distributions that make them 
readily identifiable from their distributions. A few examples will serve to stress the need for the crypt- 
analyst’s broad experience and contact with many systems, and the need for tucking away in one’s 
mind the phenomena associated with the systems he has encountered, either personally or vicariously. 

(1) The simplest case of all, transposition of plain text, is easily recognizable by its frequency dis- 
tribution profile, which matches that of the particular language involved. Thus, for English plain text, 
the theoretical profile for 200 letters is the following: 


oe THI TL THI 

DA TAL TAU DHE TAY TY 
"NW / 

Qill 


wi// 
a TAY AY PY 


QM / 

OW I 
CM 

q, 

Sie 
TAL THU TAL 
© 7H TAL THI 
7D TN PHL TL 
OITA TH IT 
13 TAU DHE DH TI 


z z z 
M P U 


</i 


Sil 


+S IT 


Q XYZ 

The quick earmarks of a transposition cipher are (1) the high vowel count (approximately 40%) as 
compared with that of random text (23%), and (2) the low frequency of certain letters of the language 
involved (in English, the combined frequency of JKQXZ=1.4%). If we obtain the following distributional 


profile, 


z 
z s = 
z z z zz Z=Z 
Z2 w.~3 2. =8 = 22 zzz 
S 22322222 eon ee Z2F2ZZSS 
ABCDEFGHIJKLMNOPQRS TUVWXYZ 
35 Adapted from Howard H. Campaigne, The Index of Coincidence, National Security Agency, 1965. 
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we diagnose it immediately as that of a direct standard alphabet encipherment, since what we have is 
_ the normal profile displaced by three positions (A,=D,). Likewise, the profile 


= 
= = z= 
z= zz z z z 
zzz 22 Zn ~2ZS._ = 
ZZB2B_ZZRBZZL ZBBZSFZRZa FZ FSLSREZ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


> 


reveals itself as that of a reversed standard alphabet encipherment, since it can 
the reversed normal profile, at a slide of —6(A,=T,). 

(2) Although Porta systems * are rarely encountered, nevertheless we should still know enough 
to recognize immediately distributions arising from encipherment by a Porta table. In the normal 
Porta, if we draw a vertical line between the M and N of the distribution, we can fit a cyclic permutation 
of the first half (A-M) of the normal sequence in the right half of the distribution, and we can fit a cyclic 
permutation of the Jast half (N-Z) of the normal sequence in the /eft half of the distribution; moreover, 
since Porta encipherment is reciprocal, establishing an identity in one half of the distribution auto- 
matically establishes an identity in the other half. For example, in the theoretical distribution below, 


e recognized that it is 


z 
= = z 
zz z= z z x 
zz Z2z Zz. xz = = ~&8 
S.8 BEBRBLRBZRPZRZBTBFZ ~BEZZ AZZ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
it is clear that the plaintext sequence A. ..E.. . Tis at cipher W . N . R, and that the 


plaintext sequence RST is at cipher IJK; flirthermote, establishing one letter, say N.=E,, then the re- 
ciprocal value N,=E, must obtain. In complementary Porta (in which the A-M sequence of the table 
runs in the opposite direction from the N-Z sequence) the direction of fitting the plaintext sequences to 
the cipher must be reversed, as in the following example: 


z 
5 ss x 
Zz zz x z z 
Z2B2z zz Z= ~H2B~ 2 ss 
RBSB2BZZ.42RF Sn BBVA AABAaZZZd 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Here the plaintext sequence A . E I is at cipher W S . O, and the plain- 


text sequence RST is at cipher FED. 

(3) A monoalphabetic distribution is recognized by its roughness, which will be that of the under- 
lying text. For English, the expected 6 I.C. is 1.73, and a 200-letter distribution involving a mixed alphabet 
might look as follows: 


D> PAU UA IAL TL 
OPAL 
Om! 
Ply 

"7 DM I 

Q pH 

aL Pad PU 
HW i 
TE UT 
A PHL DL NY 
C yi 

= Ml 

Zl 

© PHIL 
"ODI TN I 
© PNET ML IE 
FO IIIT 
TA 

3 /// 
SM / 
</i/ 

=/ 

Ps Hill 

re // 

N 


B 


36 Cf. par. 23 (on pp. 45-47) of Miliary Cryptanalytics, Part 1]. 
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The monographic roughness will prevail] not only in monoalphabetic substitution, but also in polyalpha- 
betic substitution after the ciphertext letters have been properly allocated into the respective cipher 
alphabets to which they belong, since this has the effect of reducing the polyalphabetic text to mono- 
alphabetic terms. If this step has not been correctly performed, the resultant distributions will be a merger 
of two or more monoalphabetic distributions; and if the distributions which were merged are of equal 
size, the expected 6 I.C. is 1.00 plus 1/m of the bulge of the I.C. of the underlying text, where m is the 
number of distributions that were merged. Thus, if a 300-letter periodic polyalphabetic cipher of a period 
of 30 were incorrectly assumed to have a period of 15, the expected I.C. of the distributions (and therefore 


also that of the over-all width write-out) would be 1.004 23 =1.37; or if the period were mistakenly 


assumed to be 10, the expected I.C. would be 1.00423 1.24. Such indices can therefore be a guide to 


what is happening, because if we had written out our cipher text on a width of 10 and obtained an I.C. 
of 1.24, on observing that this has one-third the bulge expected for English plain text we might have 
suspected that the true period is 30 and not 10 as assumed. 


(4) The Gronsfeld system,” in which each plaintext letter has as its cipher equivalent either itself 
or one of the nine letters following it in the normal alphabetical sequence, has a characteristic frequency 
distribution even (or especially so) if the source of key is a large book of random digits. The theoretical 
relative frequencies are shown below, for English underlying text: 


A 3.84 G 3.56 L 3.96 Q 3.58 Vv 4.80 
B 3.18 H 3.85 M 3.90 R 4.00 W 4.71 
C 2.88 I 4.40 N 4.28 5S 3.88 X 3.96 
D 2.38 J 4.40 0 3.73 T 4.78 Y 3.40 
E 3.42 K 3.70 P 3.71 U 5.01 Z 3.14 
F 3.55 100.00 
The y I.C. of this distribution (multiplying the entries above by 100) is 26(3,940,534) _ 1 goas, which is 


(10,000)? 
the characteristic roughness expected of a Gronsfeld cipher.** The distributional profile is the following 
(on a base of 500): 


Su = ESSE ZBZBSFSZSSSBZSZTZZZZs r 
ZZS 2 ZBZRBAZZZZZZ~RZZTZZZRTWZWZZWTZZZ 
22222 2ZX~XZCZAZZAZAXZZAZTZZZZZZZZ 
2242 BBX HRZA~FZFARAZZZAZZZABAZZZZZZ 
ABCDEFGHIJKLMNOPQRSTUVWXY2Z 


7” Cf. par. 24 (on pp. 47-48) of Military Cryptanalyiics, Part I. 
38 We use the y J.C. here because we are assuming the composition of the universe or total population. 
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A quick test for identifying a Gronsfeld cipher is as follows: the four highest cipher letters (T, U, V, W) 
have a combined theoretical frequency of 19.3%, and the two lowest cipher letters (C and p) have a 
TUVW 





of the cipher letters is 573 =3.67, as compared with 


=2 for a random (i.e., equiprobable) population. This index, 3.67, may be used as an 


combined frequency of 5.26%, so the ratio 

4/26 
2/26 
expected value in a suspected case of Gronsfeld encipherment. As an example, let us consider the following 
distribution derived from an intercepted 1100-letter message: 


the ratio 











= = #8 
= = = zzz 
~32 z z#z2z2 25 
zzz S22 22BRBZZZZ 
= SL. 2 ZHB =~ ZAZZBZ_ZZARZZZ 
= 2 Z2BZPZAZZRB BZAFARARZZTZXTZZ 
ZSZ Z2BZA4BPAZAZw~ZZARZAZZZAZRAZAZ_Z 
Z2PRBSRBZTRZAP RA AZAARARAARZTAZWZAZE 
ZPEZRZRBZZ PBT ZTRZBZPZTARZTEZEZZZZZZ 
ZZRFPZRPRPTZAIRIARATAARAARAAZZZABZEZ 
Z22B2BZRBRBZRZZBAAZAZAAAAAZRZTAZZRWZZZZ 
Z2BZZRBAZAZPABAZTAARAZAAAZTAZAZZZZZEZ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
30 29 35 24 39 36 36 46 40 57 27 37 44 44 53 45 36 45 45 52 58 60 59 49 26 30 
Figure 172 
. 26(48,218) . ~..  . 7.0711 . 037 
The 6 I.C. is 1100(1099) 1-037; the standard deviation is 7100 = .0064; and the sigmage is “0064> 
5.80. The Gronsfeld index of Tis 5 70 =3.88, supporting the hypothesis that this is a case of Gronsfeld 
encipherment. 


(5) In complex noncrashing systems (e.g., Enigma machine systems) wherein a plaintext letter 
cannot be enciphered by itself, the 25 cipher equivalents of any plaintext letter are equiprobable, leading 
to the following theoretical relative ciphertext frequencies for English underlying text: 


A 3.70 G 3.94 L 3.86 Q 3.99 Vi 3.94 
B 3.96 H 3. 86 M 3.90 R 3.70 W 3.94 
C 3.88 I 3.70 N 3.68 S 3.76 X 3.98 
D 3.83 J 3.99 O 3.70 T 3.63 Y 3.92 
E 3.48 K 3.99 P 3.89 U 3.90 Z 4.00 
F 3.88 100. 00 


The y I.C. of the cipher text is most easily computed by the formula y.=1+ % cond where £, is the bulge 


of the J.C. of the plain (i-e., yp— 1.00) and ¢ is the number of categories; therefore y=1+ 7. ~ Geprl 0012. 
A property of such systems is that, if the distribution of the cipher letters is made in the descending 
frequency order of the plaintext letters of the language, the slope of frequencies of the ciphertext letters 
will be that of a gradual ascent; thus: 


E 3.48 I 3.70 C 3.88 Y 3.92 X 3.98 
T 3.63 S 3.76 F 3.88 G 3.94 Q 3.99 
N 3.68 D 3.83 P 3.89 W 3.94 K 3.99 
R 3.70 L 3.86 U 3.90 V 3.94 J 3.99 
O 3.70 H 3.86 M 3.90 B 3.96 Z 4.00 
A 3.70 100. 00. 
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Or, in tally-mark form (to a base of 1000 letters) : 


=~ se te Se TeOU Eel Teh Sel STU TOS 


~ BS SeeeSBSBPBPSPSPSPSPBPSSRBESEZ2~ZAZZZEZ 
Z2ZZZZZZZFBZFRAZW~ARZZAZABZHZZZZZZ 
2222 ZZZW~ZAZAZZA~ZABAZZZAZZZZZZZ 
ZZ ZEZFZZZFRARAZBZZTZAZZZAZZZZZZZZ 
Z2ZZZZZA~PZAZZAZARZRAZZAAZZZZZZZ 
ZZZZZWR@RBWZ~AZZAZZZA~ZRZZAZZZZZZZ 
ZZRZZZZ~AZZAZZ~RAZAZAZZZAZZZZZZZ 
ZZRZZZZFZZAZRZRZAZA~ZZAZZ~EZZWZZZZEZ 
ETNROAISDLHCFPUMYGWVBXQKJZ 


The slope is so gradual that usually about 8000 letters are required for a positive determination. As an 
example, let us study the following combined frequency distribution of a number of messages, totalling 
4306 letters: 


167, «171:«189' «-152)s 141) :159 194. 152) 146 «162154 167) 165) «137 s:150 «182, 189-188 «172, «187 :1638)— 172, s«159 179-174-185 


A BC DE F GH IJK LM N O P QRS T UV WX ¥ Z 


Saran = 1.0087 ; the standard deviation is Pane ee 
=2.3c. On the hypothesis that this might possibly be a noncrashing encipherment of English plain text, 
we construct the distribution in the descending frequency order of English plaintext letters; this is shown 
by the bar graph in Fig. 173, below. Since the distributional sample is small, we try to smooth the rough 
bar graph by averaging every pair of letters; this is shown in the figure by the line composed of dashes. 
Then, in order further to improve matters, we average pairs of averages—we’re trying very hard to 
make things come out the way we wish—and this plotting (shown by the line composed of dots) now 
displays a gradual ascent from left to right, so we have proved our point. 

(6) In plaintext autokey systems, and also in other systems in which the key is literal plain text 
derived from a book or other source, the expected I.C. will show a measurable departure from random. 


The bulge of the I.C. (i.e., the excess over random) may be calculated by the formula p= Pe, where 
8, is the bulge of the cipher text, 8, the bulge of the plain text (for English, .73), 6, the bulge of the key 
(which, since the key text is plain text, is also .73), and c is the number of categories (in this case, 26). 
Thus the expected bulge of this type of traffic, without regard to the identity of the components in- 
BS ons, so the expected. I.C. is 1.02 in the general case. When the components are 
known sequences, the theoretical distribution for the ciphertext letters may be computed, as well as 
the I.C. of the specific case. For example, where the components are direct standard alphabets, the 
relative frequencies are the following (reduced to a base of 1000 letters): 


The 6 IC. is 








= ,00164; and the sigmage is 


volved, is 





A 40.6 G 45.9 L 41.5 Q 30.9 vV 51.7 
B 35.3 H 41.8 M 43.5 R 47.2 W  A7.3 
C 31.6 I 50.5 N 30.1 S 42.2 X 40.9 
D 25.0 J 30.1 0 28.0 T 41.5 Y 31.5 
E 47.5 K 35.9 P 34.3 U 30.4 Z __35.5 
F 39.3 1000.0 


The kappa or repeat rate (i.e., the sum of the squares of the probabilities of the cipher letters) is found 
to be .0398; therefore the theoretical I.C. for direct standard alphabets is 26(.0398)=1.0348. Where 
the components are reversed standard alphabets, the relative frequencies are the following (to a base 
of 1000 letters) : 


A 66.9 G 34.8 L 45.4 Q 37.7 V 34.4 
B 39.9 H 33.9 M 37.4 R 38.1 W 44.1 
C 34.1 I 31.3 N 46.7 5 31.3 X . 32.1 
D 32.1 J 38.1 0 37.4 T 33.9 Y 34.1 
E 44.1 K 37.7 P 45.4 U 34.8 Z_ 39.9 
F 34.4 1000.0 
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ET N ROA IS DLH CF PUM YG WVBXKQK J Z 
141 187 137 138 150 167 146 172 152 167 152 189 159 182 163 165 174 194 159 172 171 179 189 154 162 185 


164 138 159 159 159 171 171 164 184 166 175 172 179 
151 159 165 167 175 173 179 


Figurr 173 


The kappa here too is .0398, so the theoretical I.C. for reversed standard alphabets happens to be the 
same as that for direct standard alphabets, namely, 1.0348. (Note in particular a striking property of 
this distribution: not only is the frequency of A, outstanding, about twice that of the average of the other 
letters, but the distribution is symmetrical about A., so that the frequency of Be=Ze, Ce=Ye, De=Xe, etc.) 
For a quick test to determine whether direct standard alphabets have been used, under the assumption 





of plaintext keying, we take the ratio Rep penh7 : and, for testing for reversed standard alphabets. 
. ANLP 204 : i 
we take the ratio DXIS 19771 (The expected value for random in both cases is of course 1.0.) More 


precise measurement would involve the use of the chi-square test of a sample against the theoretical 
distribution of the assumed population. 

(7) In numerical cryptosystems, one of the most striking distributional profiles is that of the classic 
Nihilist system,*® which involves encipherment (usually periodic) by an additive key which is derived 
from plain text, applied to intermediate text produced by a 5X5 bipartite square with the row- and 
column coordinates consisting of the digits 1-5 in normal order, the interior of the square containing the 





89 Cf. par. 81 (on pp. 208-218) of Military Cryptanalytics, Part IJ. 
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letters A~Z inscribed in straight horizontals (with I and J in the same cell). The following distribution 
of a 210-digit cryptogram is typical: 


C9 TITY TAY TY 

os THY TUTE / 

Ov TAY TAL TEAL DAY TH HAL 

> THY THE THU DHE THE TAAL PH TAL 
UTRU DH THE DRY THD TRUTH TR 
0 PHU DAY TAL DE THRE THE 

CO THI THE TAL TU 


z 
0 


~ 
00 Hl 


The virtual absence of the digit 1, the low frequency of 0 and 2, and the characteristic curve of the 
digits 3-9 are earmarks of this system, without regard to the length of the additive key. Certain other 
numerical systems, especially those used without superencipherment, also have distinctive profiles; 
among the most common of these are monome-dinome systems,” particularly those having two or three 
medium- or low-frequency letters in the top row of the enciphering matrix. Two typical distributions 
are shown in Figs. 174@ and 0, below: 


= = es z 

= &§ zz Zz = 

=z z = Ss zz z= = 

z z Zz =z S22 82 2  j 

= #2 8&8 z= 222ZF 2F FSB 

222 ZSSZz 2B Z2ZZReFZTn ZAZZ 

Z22Z Z2BZZZSEZ ZZZRBZRAAZBAZ 

0123456789 0123456789 
Fiqure 174a Figure 1746 


The row coordinates of monome-dinome matrices will be found among the digits of highest frequency: 
in Fig. 174a, they are 0 and 2; in Fig. 1746 they happen to be 1, 5, and 7. The I.C.’s of the matrices will 
vary, from the lowest possible I.C. of 1.002 to those above 2.00, but in operational cases encountered 
wherein the top row consists of a key word, the I.C.’s of matrices with two numbered rows are usually 
in the vicinity of 1.30 to 1.50." 

(8) The criterion of 40% vowels should not be the sole basis for the identification of a transposition 
cipher, because there exist substitution systems in which the vowels are abnormally high in the cipher 
text. For example, (a) 5-letter codes in which two of the letters in each group are vowels, and (b) certain 
manual and machine cryptosystems (e.g., the ‘‘transpositeur 4 permutations secrétes,”’ a French com- 
mercial cipher device “) in which vowels are enciphered by vowels, consonants by consonants. In the 
former case, the 5-letter code with 2 vowels in each group would be instantly recognized for what it is; 
if, however, the code groups were further enciphered by a transposition system the phenomena of the 
individual code groups would be lost, but the over-all text would still contain exactly 40% vowels—in 
fact, the figure of exactly 40%, if consistent in several messages, would be sufficient cause for suspicion. 

(9) There have been instances of combined substitution-transposition systems involving standard- 
alphabet monoalphabetic substitution and single columnar transposition. The frequency distribution 
would reveal the standard-alphabet encipherment, which when removed would leave as a residue the 
transposition which can then be easily solved. In those cases involving transposition followed by periodic 
polyalphabetic substitution with standard alphabets, the period may be determined by writing out the 
text on various widths, with confirmation by the average 6 I.C. of the columns of the correct width. 


40 Cf. Chapter X, Military Cryptanalytics, Part I. 
t For a discussion of the I.C.’s of different matrices, see par. 89 (on pp. 261-263) of Military Cryptanalytics, Part IT. 
# Cf. par. 76 (on pp. 190-197) of Military Cryptanalytics, Part II. d 
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‘(In favorable cases, there may even be polygraphic repetitions at intervals whose factors give a clue to 
the period.) The substitution can then be easily removed by fitting the distributions to the normal; * 
what is left, the transposition, can be attacked without complications. If periodic polyalphabetic sub- 
stitution is followed by transposition, the transposition must be removed first—usually a very difficult 
task—before the residue, the polyalphabetic cipher, can be attacked. Incidentally, it is to be noted that 
in combined simple substitution and transposition the monographic 6 I.C. will not reveal the fact that 
a transposition is also involved. If, however, we take a digraphic I.C., the lack of cohesion in the cipher- 
text digraphs will give an indication that a transposition is also present; furthermore, the expected 
polygraphic repetitions typical of monoalphabetic substitution will be destroyed by the transposition. 

(10) In connection with frequency distributions, it would be well to point out some subterfuges 
that have been encountered in certain systems. The first example is a 1000-letter composite frequency 
distribution, taken from severa] messages in what might be a complex cipher: 


Bm TAL TH THE TAU THY DMT PML TNE 
ge OO THI PAU TU TEP /I/ 

& 2 PAI PAPAL PRET PAU TT 

& OTA UO TTT 
eS DL PAL PAU PME DDD TI 

mS DPA THAD PAL PA TA THAD TRAD PAE TIP 
TRE TRE TIE TIRE TRC TR TREE / 
TL PHL PAL TRA TAAL PRATAP U7 
A PHL AL PAD PATA PTE TIT 
SG ANE TAL TAY DAE ONC TA PR 
ROR AL TAD TA / 
ee er LL 
TAI AI DAUD TA TPT 
ee es 

$ © PI A THU PHL ONT TAP II 
OPA TAY TH DAY DA PAT THT 
Se PAU TY TAY PRL PE DRL DAL PLD UY 
OPAL DAL TY ONT ADT 
BUD PA DAL DAL DAD DUT TDL 
8 A AAU PAT OME DAE PLONE DT 
eC PAL DAL TAT DY TMU PU TLD TIT 
<td PAY TAU TET DD PT 
Me AU PY PIII 

SPS TN DAU TAY DAD PY IY 
BS PAL PAD DAD PD PAD DAD DAD PAL 
SIN. TA PAU PAD TE DLT TY TH 


It is evident that, no matter what else is involved, the cryptosystem incorporates a 25-letter alphabet 
(perhaps without a K), thinly disguised here by making about half of the W’s into K’s. In the second ex- 
ample, shown by the cryptogram below and its accompanying frequency distribution, 


KABZW WITMJ KUNDT XCKEA FICOH QEKEF ZOUAZ CWKOZ TMKIK AEYMR 
CTZZE IVKUE OKIAK UCKEW DCKAB KIAGK ICKIM EZMKO MENDY MRKUZ 
EWZKU ECKAU HRKOM UUHDK OCWQA JKUMK IHUKU RGIGA RCAFU HYMEW 
DFHUW KAYOT RKUJA DBVMZ KOXDW FAZNC KEAFU HWKAW KATSK AKUYM 
ZNNZO KIAKU WMAFA FKURT MFEWK ARTFO MUXMZ RBVCR XOCKA BKIMY 
DWKAW EZMKO EMNBM XMZLK EAKUB WICKU JPEXX 





= 

z= 
. -18 USC 798 
= = = =z = -50 USC 3024 (4 
Zz oS = = #2 Ss = = = Sena ec 
Z2= 222 =F 2 BB ZF TFB 2s ~B 
2222 RBRZRPRAZTPZ_ BPR RZ. BZAZSZEZRZ . 
ABCDEFGHIJKLMNOPQRSTUVWXYZ ‘4 

it is clear that what we have is an expanded alphabet of 30 characters represented by 26 letters: K is - 


always followed by one of five vowels, and these K-digraphs are to be treated as single characters. _ 








co 
oO) 
t™ 
oO 
Ww 
a) 
co 
a 
I 


-50 USC 3024 (i) 


86-36 


-L. 











vaQaw 
> EH 
PHO 
HOC 
ocrK 


wee a et ee ea od 
letter letter 


NM = 
ws 

m EIH 
AHO 
HOG 
oacK 
ae 








ovaQw 
wAUaQ 
yWymo 
QQ "1 Fl 
™ @Q 
HTQ 
AH 
rARB 
=n 
2=ear 
o2: 
voz 
O00 
AO'v 
NAO 
Hn w 
aan 
<ac#H 
sZz<aa 
sas 
<P 
NK PM 
mN Ke 
Orn 
QD > 


4th 
letter 


3d 
letter 





m>NK 
Wren 
QD Pe 
0Qb0 
AON 
Wjmo 
@ 1 Fl 
Ll @ J 
Hom 
AH 
CAH 
=ZucyN 
22r 
o28 
Vom 
o'v9o 
AO 'v 
NAO 
Hn DW 
quHn 
< cH 
a<c 
“x= 
<M =a 
NK p4 








Only a few messages in this system were intercepted and the code was never broken; the only observation 
of any importance was that every message contained the group COVQ at least once. It now looks as if 
Message “‘A’’ is a monoalphabetic substitution of a message in this code, and Message “‘B”’ a transposition 
of the basic code text. 

(2) In each of the two distributions the frequencies of 10, 9, 7, and 5 occur only once; therefore 
in Message ‘‘A” we can make the decipherments D.=C,, C.=I), We=Xp, and F,=L,, as shown in the 


work sheet below: 


1 2 3 4 5 6 7 


A|DAWS MSUM WXZH FAAS PSOW TXIF 
c 6x L x L 


au 
Ha 
rc 


cy 
~*~ 


BiB S K D 
C 


BASG ICKU WHRE FXPR ICKU 
x L I 


GQ 
Ha 

oe oUt 
“= 
H 


c 


C|\J AMD 
C 


oO 
> 


DKDW ECQC RCX¥Q QCDE IXZK 
Cc cx In 2 I Ic 
DIJ HKD DKTN DAEL WACK 

c OC Cc x Tf 


The crib COVQ has only two possible placements, at D2 or D3; the frequencies of the cipher letters K, T, 
and N match exactly the frequencies of the plaintext letters 0, V, and Q in Message ‘‘B”’, so these decipher- 
ments may be made. Furthermore, in the six vowel equivalents (A, C, H, K, S, X) of Message-‘A”’ we can 
identify H.=A, by comparing the frequency distributions of the two messages; and since K, (which has 
a frequency of 8) has already been identified as 0, from the COVQ crib, then the only other remaining 
cipher letter with a frequency of 8, A,, must therefore represent E,. Our work sheet will now look as 
follows: 
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1 2 3 4 5 6 7 
AIDAWS DCFL MSUM XWZH FAAS PSOW TXIF 
CEX cI XY A EE X VY 
BIBSKD JCFW BASG ICKU WHRE FXPR ICKU 

oc I x E Io XA Y I 0 
CIJ AMD QAXL DKDW ECQC RCXQ QCDE IXZK 

E C Y cocx I ot IY Ic Y O 
DIJHKD DKTN DAEL WACK . 

AOQC COVQ CE XEIO 


(3) From here on the solution of Message ‘‘A” is automatic. The partially recovered groups CEX-, 
XY—A, and —AOC can now be completed as CEXU, XYZA, and NAQC by means of the permutation table, 
and these decipherments will snowball into a complete reconstruction of the plain code message: 


CEXU CILG PUFP XYZA LEEU SURX VYHL 
JuUuOC NILX JEUM HIOF XADK LYSD HIOF 
NEPC TEYG COCX KITI DIYT TICK HYZO 
NAOC COVQ CEKG XETIO 

The substitution alphabet, which should have been compiled concurrently with the reconstruction of the 


plain text,” is found to be as follows: 
P: ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Cc: HYDRAULICBEFGJKMNOPQSTVWX2Z 


Having reconstructed the underlying plain code of Messages “A” and “B”’, we can now recover the trans- 
position rectangle used to encipher Message ‘‘B’’, together with the numerical key: *8 


It will be observed that the blank cells in the matrix are systematically placed: in the first row, at key 
positions 1, 2, and 3; in the second row, at 4, 5, and 6; and so forth, with perhaps blanks in a possible 
seventh row at positions 19, 20, and 21 for this particular key. The blanks in the matrix vitiate any 
attempts at anagramming the columns, which would have been possible with the COVQ crib had there 
been no blanks. Thus neither message is solvable individually, but they are vulnerable when taken 
together. 


47 This sin of omission was purposely committed in this example so that the more general technique of solution, which 
would not rest on the systematic construction of the enciphering alphabet, could be demonstrated. 

48 The reader might like to recover the literal key from which this numerical key was derived. See in this connection 
' pp. 427-429 of Military Cryptanalytics, Part IT. 
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SECRET 


(6) —_ properties, ae = associations a a - intoanunknown , 


cryptosystem. Let us study the following message and its accompanying uniliteral distribution: 





BDAUB UARAD LDZRB CKQFN FMQVB RZDNB 

YQZUR BMWZC CENAE UDALG BNNZL UFPEM 

RXQAK CNKVD KGKDU FWUBQ DZRZP YRKGY 

CYWGZ NBPBN AMYND WTCKP AQRVA NAGGK 

XNFQN BDBMF IMDKX DQYAM DYKCP SFRYU 

QVVRR ITUWQY MSFUQ XKPYD VNMAR YBQWN 

GWCKO YYRXU KRUAC BGLAD RBNYO BPBNV 

OVKOK RFUMH AQKNI QNAMV AUNIB DOKGB 

ZRFMD XBRFO XRCBD VRFIG BPFNQ IARVD 

VQVRP XANFD INYPK NYCOW QKYO0Q BYMKM 

VNVQH QRXYC YQFRV UXNUV ULYGU TIPWD 

KDBCF DNKVO NFQFC KPBRA PKOHY RBGRY 

HORKN XHMAC SUIRF QYPYN DFBOX 
= = oe zs -18 USC 798 
ZEZZ Zs = 2FZ.S 22 ZZ .f 86-36 
ZZZZz ZZ S BF BZZZZR Zz2S2zS 
ZZPZZSPZZZ BPBZPBZBZBZZZSr ZZZZZE 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


An interesting profile, no J, a 6 J.C. of 1.28 representing a deviation of 15c. Digraphic distributions are 
now made, on and off the cut; these are shown in Figs. 176a and 6 on the next page. The digraphic I.C. 


of the on-cut distribution (fig. 176a) is ALS) =1.57, while that of the off-cut distribution (Fig. 1765) 


192X191 
8 aR = 1.36. Although wart doublets are expected if the 25 letters present were equiprobable, 


and even more in the case at hand with such a rough uniliteral distribution, Fig. 1765 has only 5 doublets 
whereas Fig. 176a has none whatsoever. Furthermore, Fig. 176a shows some striking properties in the 
physical appearance of the distribution, displaying affinities of some letters for others, and apparent 
matching propensities among the rows and columns of the distribution; moreover, since there is an ap- 
parent symmetry about the main diagonal (from upper left to lower right), this means that the matching 
of rows also corresponds to identical matching of the columns. Since this now bespeaks a biliteral system 
with a commutative matrix, we divide the text into digraphs 








BD AU BU AR AD LD ZR BX KQ FN FM QV BR ZD NB . 
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Pirad dt tt ttt tte bt bts tet )tebred Nj/latiattat)t ttt ttt taawt bt tia tia 
Flatt tA TP bei btiatrttrnee st ttt il Sl broaA ll ia bl PARA ANTRAL IT I tb ide 
Pita bt bt tb tb i tat tare dt d)d-)rdvee as] ror bi bt bt bt trem tp inensep tat tea tp) 
Prra tte ttt ti tata te tp be tet te) dd elit t t toad tt ttt tt tae tt) bbb dda 
tb bet th bt bt bt tata TR t teat tt bl >jlraretiitititr nteaA tf rant ttiatt et 
Ra trAnNRti tii t_iea t i lt tid bt tant ates PlirelL tla tia ta Pi triad eta dt tia tt) 
Prt t tt ttt bt tt bette tt pt pea to pdb) tt B}]i tt tt bt bt tb bt to bet be bob dep bet bt bet todd 
Ce ee De DO OO | mil tat tt tit tt bt tv t ett ttt tp’ 
Nel r1rirntilra tTuetritttt prrttinriaAranren wVloaAa tbat tia ti ’ri lta tA TRAD baa | tae 
uri bi intiaaAtnat ft tt titritrtrinetting wll ti trata tt tities ttt tr ininnt 4 
re rr trae ttaA tT Nutt’ s ttt pr rrtrrinet GBQlasto ttre tt t tat ti ’t ttattiueti di” 
[is = O;}lla~ea ds te tps ynrmsep esp dye dpe pope 
Nei rirnt tra tintti tt rit ti bttinwntarnea s ZlINANATL IL LI ta lt iatea IRE tbat dl 
RQllilAnNtaAret trot tttitiprtttapebet be ZBranritti sy tt sb bs pt tart tts te tbat tit 
Prerdt t tatttttt sb tt et be teaeded gd » Aja tliat tists tbtuettp vt tt tert trrirtia 
Finke tla ts Pt bt ds rrr ane tt rrtdtl FS MIA INR lL iat lt t bat tian a J Lt baa tae | 
Le ee ee ee | syylor_r do do vob v vt bt dt te tt t)tt tt tbe) be 
Protrt tt @t bt bb tat Pee te bbb dd Hitt rot)rmibet tt tts tt tt tbat td 
Pedre_ td tpt ttt ta tat) pet dt ta at fo OO 
Aqt ltt bia tat edt db pdt tb tte te o;ratt tl tatt_tintriartstttittt ese 
Praia ti ttt ti teat tiae bt tati side kK] lo beadt tb) ti tt ttt iminantnrtat tid 
Pratt t tt tt tt tt bet bt tet et be bet beet aya tt t tb ttt ttt tt beet tt tt bt tea et 
Reel lr rntl tt r_~rnattr itt tt bt binkatnnea AlLInti trl titi’ tp tment rat tsa tie) da 
Hatter t tbr tl ime pt tt bt bt tee tb dt iRea ofa ia ttlattittt'ttttttett bt} tstta 
Fira tl tra tt’ tt trmannre titted Qi il llaATAN TAT TPP ta tan TRL ERA lA a 
Prorat tb’ tt tbat tbat teat “/llia ll bas | lA AN TR ITAL PAN Tae 
AMOANRODHHO KY SBAZOMOMNHDS> EX HN SMOAHMROTMHYTMHA SACL OMNHD PE MAN 


Figure 176d 
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and proceed to establish the two families of letters in the manner illustrated in subpar. f(10), above, 
arriving at the following groupings of 15 and 10 letters: 


ABEFHIKLSTVWXYZ/]CDGMNOPQRU 


From the distribution in Fig. 176a we see that the A, F, and V rows match (and also these columns), 
and we may continue the matching process until we reconstruct the 15 variant row coordinates and the 
10 variant column coordinates of what becomes a 5 x 5 matrix. Then, using an arbitrary A~Z sequence 
within the square, we may reduce the biliteral cipher text to monoalphabetic terms. If slight errors 
are made in the matching, these can be caught and corrected during the recovery of the plain text.” 

(7) In the next case to be studied, we have the following cryptogram and its accompanying 


distribution: 


CWIEL XGQZB WELVA EDNLQ OIFPZOKWZM 
WIFVF QIFTB XEGQL PZIKW CPEJV IDVID 
QLWZK QULTF WCWLE LVFQZ UJTZC PFNII 
DQFRO KNDTI BTZJIN UKTDN UFSOK WCVZO 
FPZOL WIKPO MRIBR ZLTID XULNF WGTZF 
VOMPZ MXIFN UZCSO KNDTI HRGYZ LQLYU 
ZIOCV CWFQZ CNOFX IZLSU ADQHX IBXMY 
ZLWJQ FTIIZ GXYILT UZGRI LTUZD POLVFE 
PODWJ VHNZA FNJPI KQLWD TMWZF NIDYA 
ILVLW ZLNIO DQJTU FTHWI KPIKW FQFPZ 

= z= =a = 

z z z 3 z 

= 2 Zz .~#2 8822 Pea z 

SZPLFZL Ba BZ_ PREZ Z22Z2225 2 

SPFPRRPRFRBRPRTWPWTRRPRWBZSPRWZARSE 

ABCDEFGHIJKLMNOPQRSTUVWXKYZ 


Another interesting profile, with an I.C. of 1.28 representing a deviation of 12c. The one hexagraphic 
repetition present is at an interval of 70, and the two pentagraphic repetitions are at intervals of 71 
and 7, so no common factor is involved. Digraphic distributions are now made, on and off the cut, and 
since these show considerable similarity it means that the cut makes no difference; the two distributions 
are therefore combined, as shown in Fig. 177, below. There seems to be a remarkable affinity for the 
letters A~M to contact letters in the last half of the alphabet and vice versa, with the exception of the 
vowels A, E, I, 0, and U; the letter Z also seems not to fit the pattern (note the appearance of the last 
column of the distribution). In examining the cipher text more closely, it is seen that consonants are 
clustered in pairs (if we exclude Z), and that these pairs always consist of a letter from the first half 
of the alphabet followed by a letter from the last half (Y here behaves as a member of the consonant 
family). No property is discernible among the vowels, other than the fact that they are reluctant to con- 
tact each other—there are only 10 such contacts among the 64 vowels AEIOU present; furthermore, 
the only doublets in the cipher text are the two occurrences of the digraph II. We now conclude that 
what we have is a uniliteral-biliteral system. We note that the message contains 64 vowels and [05 
consonant digraph elements, making a total of 169 underlying plaintext elements. If the cipher vowels 
actually represent plaintext vowels (say some arrangement of A, E, I, 0, and U), and the consonant cipher 
digraphs represent plaintext consonants (with variants), the ratio of 64:169 is a percentage of 37.9%, 
which would be acceptable under this hypothesis. Furthermore, the Z, which might have been assumed 
to be a null may now be considered, not only from its spacing throughout the cipher text but also from 
its frequency of 26 out of the 169 plaintext elements (=15.4%) to be a word separator. (The long stretch 
of 23 cipher letters between the Z’s in the last line of the cipher represents only 14 plaintext letters, so 
that the assumption of a word separator is quite plausible.) The completion of the solution is again left 
to the reader as an instructive exercise. 


*! Completion of the solution is left to the reader as an exercise. 
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Fiaure 177 


(8) As a final admonition on the recognition of variant phenomena, let us consider an aspect that 
might escape our notice. We have at hand the following four message beginnings: 


(a) 77790 26062 54876 06579 10093 44420 90978 84898 08236 . 
(b) 95743 42558 03993 11928 74140 29556 30307 92815 00311 . 
(c) 88521 84625 51975 71358 47204 07600 39699 59667 683531 . 
(d) 69674 03906 14939 22790 85401 91774 89689 43339 45359 . 


Nothing out of the ordinary is seen, until we divide the texts into trinomes: 


(a) T77 902 606 254 876 065 791 009 344 420 909 788 489 808 236 . 
(b) 957 434 255 803 993 119 287 414 029 556 303 079 281 500 311 . 
(c) 885 218 462 551 975 713 584 720 407 600 396 995 966 768 331 . 
(d) 696 740 390 614 939 227 908 540 191 774 896 894 333 945 359 . 


Just when we are about to let this go by, too, we suddenly note that the trinomes in the first column all 
sum to 21, and that all those in the second column sum to 11; in fact, each of the first 9 columns has 
trinomes summing to a fixed number. The system is now identified as a summing-trinome system, in 
which each plaintext letter is assigned a unique value of 1 to 26; this value is then expressed as a tri- 
nome, the digits of which sum to the designated value of the letter. The idiomorphic pattern of the stero- 
typed initial 9-letter word reveals itself as REFERENCE, and the message beginnings are now read with 
ease and all keys recovered. 
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(9) Repetitive phenomena associated with certain general types of cryptosystems are easily recog- 
nized for what they are. For example, if the polygraphic repetitions present in a cryptogram are pre- 
dominantly of even length, and if the intervals between these repetitions are all even, this may indicate 
a digraphic system, or for that matter a biliteral system such as a 2-letter code; if the majority of the 
repetitions in digit traffic are of lengths divisible by 3, and if the intervals between them are also divisible 
by 3, obviously either a 3-digit code is involved, or a trinome cipher system of some sort. If the majority 
of polygraphic repetitions are not only pentagraphic, but also across the entire group (i.e., begining in 
the @ position and ending in the e position of the 5-letter groups), 5-letter code is indicated, or some other 
type of pentagraphic encipherment such as the periodic fractionation system shown below, in which the 
vertical dinome encipherments within each group are recombined horizontally and converted back to 
letters, using the same fractionating square: 





12345 

l1JABCDE 

2\F GHIK 

3|L MN OP 

4;QRSTU 

S|IVWX YZ 
THREE OFFIC ERSAN DFOUR THREE ENLIS. 
42411 382221 14413 12344 42411 13324 
43255 41143 52313 41452 43255 53143 
RQDMZ MGDAS DQPHC BOTDW RQDMZ CMULS 


The intervals between all causal repetitions here will be factorable by 5, and in the main these repetitions 
will extend across one or more full groups. If, on the other hand, traffic were enciphered by a 5-alphabet 
periodic polyalphabetic substitution system, even though the intervals between repetitions would still 
be factorable by 5, the repetitions would be of varying lengths, and furthermore, distributions of the 
columns of the text when it is written on a width of 5 would show unmistakable evidence of mono- 
alphabeticity. 

(10) In periodic polyalphabetic substitution systems the intervals between the longer (and therefore 
less likely to be random) polygraphic repetitions are expected to correspond to the length of the period 
or multiples of the period. That this is not invariably true is shown by the following case of periodic 
polyalphabetic encipherment containing a repeated pentagraph at an interval of 26, which in a sample 
of this size represents odds of more than 1000-to-1 against having arisen by pure chance: ” 


EEYMF RNNSP UUEUD SLIUR AUFJS ETSFV 
KNVVD SXDSA FTHXH JOZTW OCRZR AGLCA 
RSXDS AEYZZ YTRLL EGIFR OEBVU FEYHK 
UYBCQ OKOOA VZTBW BNTBG XECTITQ AMQCA 
SOKBV RFZFK NCBUH NZIFZ LMTVS HVPFJ 
=~ =z ~= S285 = 
Z2PZRBIRBPS ZS PBS RPS PRWRRZZ i TZZ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


®2 An easy way to calculate this is as follows. Since in this sample of 150 letters there are 146 pentagraphs possible, the 
expected number of pentagraphic repetitions (R) is given by the formula R=N& 2) M6T® = 0.00089. Where the 


expectation is small, the expected number is an indication of the probability and therefore may be translated quite ac- 
TD or 1128 to 1. 








curately into odds. In this case, then, the odds against a random pentagraphic repetition are 
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- The over-all 5 I.C. of 1.003 supports the possibility of a large number of alphabets, so the text is written 
on a width of 26: 


5 10 15 20 25 26 
EEYMFRNNSPUUEUDSLIURAUFJSE 
TSFVKNVVDSXDSAFTHXHJOZTWOC 
RZRAGLCARSXDSAEYZZYTRLLEGI 
FROEBVUFEYHKUYBCQOKOOAVZTB 
WBNTBGXECIQAMQCASOKBVRFZFK 
NCBUHNZIFZLMTVSHVPFJ 
= 2..°:2 2. 2 2 2.2 222 2 2 2 =26 

26(26) 


The I.C. of this array is =0.94, showing that it is not periodic encipherment with 26 alpha- 


26(76) - 
10(8-7) +10(7-6) 
2.02, proving this period and indicating to us that what must have happened is that the keying sequence 
must have contained a repeated segment: the polygraph of key elements 2-6 is identical to that of key 
elements 16-20. A pentagraphic repetition in a cipher message of 150 letters must be causal (i.e., it must 
have been produced by the application of identical keys to identical plain text) but it does not mean that 
it is the result of periodic repetition of the total key.® 
10 


20(6-5) +6(5-4) 
bets. When, however, the cipher text is written on a width of 20, the I.C. of the array is 


_ 
on 
y 
o 


5 
EEYMFRNNSPUUEUDSLIUR 
AUFJSETSFVKNVVDSXDSA 
FTHXHJOZTWOCRZRAGLCA 
RSXDSAEYZZYTRLLEGIFR 
OEBVUFEYHKUYBCQOKOOA 
VZTBWBNTBGXECIQAMQCA 
SOKBVRFZFKNCBUHNZIFZ 
LMTVSHVPFJ 

= 22 4 6 2 44 6 2 2 2 4 2 4 4 2 6 4 «14 =76 


(11) When long, interrupted polygraphic repetitions (i.e., with occasional nonhitting portions) are 
found, these are telltale earmarks of variant systems. Note the following ciphertext passages: 


(a) ...FI_CM TD VG PM IA ML TH PE VR AY DF BD US. 
(bo) ...FI_CM TD VG DS IA ML TH DY VR FR DF BD US. 


Care must be taken, of course, to discount the possibility of the nonhitting portions’ being nulls; the find- 
ing of other similar interrupted polygraphic repetitions should confirm the variant hypothesis, and the 
analyst should be on his way to establishing the variant values for the as yet unknown plaintext letters. 
That near-repetitions are not always the by-product of variant systems may be illustrated by the 
following example of five selected pairs of message beginnings based on a situation once encountered 
operationally : 


(a) 


ep) 
J 
oO 
10) 
KO 
ww 
J 
no 
an 
AN 
oO 
ol 
no 


(b) 





CIA 


rw NO [WIN 


(c) 


CA 
lor 
~y 
oO 
loy 
| 
iO 
bd LAL 
~j 
Ino 
Oro lee In 


a 
Qin FO [Fle 
a Id 
ai 
nm [09 


(qd) 





hs 
q 
nN 
‘| 
lcoico 1c0lIO OW 


moan noo NA PIN 


cA 100 100 


(e) 


ro AN 
IP Ie [BPR Ro [eR pA pA 


AO AO AD AC [N[W 
AD [D1D [DIM [M/M |D|w 
Oa join joo jojo loig 
Ino Ih pole fooled [A919 [29 [ro 
ONRINN WN RIN WIN 
NIN RIN LIN ININ NIN 
CIA lala [a 
DID |p 

be 
oo 
ab FO NN OOM 
NO of DO ON WO 
PN nw Ah FO OW 
Or won ar AN OF 
YVDIO OW WN WO 
no Do AO IMDIN OA 


[ds Ts 
or 
ew 


no 

CA 
OlO 
al 


1 


« This example involves direct standard alphabets. The reader might find it profitable to solve it by the method of 
completing the plain-component sequence and to discover the repeating key in the process. 
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From the appearance of these repetitions, after no doubt a considerable amount of study, we may con- 
jecture (a) that the method of encryption encompasses five groups at a time; (b) that similar beginnings 
are present, involving in the main the first four groups; and (c) that, as a result of observing the pre- 
dominantly symmetrically placed hits with the A3 group as the center, the manner of encryption 
involves dinomic substitution starting with elements of the central group, fanning outward until elements 
of the first and last groups (i.e., the Al and A5) are combined. This will be clarified by studying the 
following example of the encryption of a message beginning, using the dinome substitution table shown 
below: 


4320 03665. 
52 





1 
1 
6 7 8 9 
18 


OONOUAANE O 
e 
nw 
oO 
a 
oO 
we 
A 
ol 
on 
© 
Oo 
A 
o 
~q 
~w 
oO 
n 
wn 
16 0) 





The central digit of the A3 is left unenciphered, the 6 and d digits (8,'7) are enciphered dinomically as 
(6,0) and replaced in the corresponding positions, and the @ and e digits (1,3) are enciphered as (3,6). 
This process is continued in gradually expanding dinomic treatment until the 6 digit (1) of the Al is 
combined with the d digit (6) of the A5 group to yield the dinome (7,5), and finally the a digit (0) of 
Al is combined with the e digit (5) of A5 to yield the dinome (3,2). The feature of reciprocal dinomic 
substitution incorporated in the table avoids the possible cipher clerk’s error of using the deciphering 
table for encipherment. As an anticlimatic revelation, the system on which this example is based was 
not solved cryptanalytically, nor for that matter even diagnosed, but instead was read as a result of 
adroit tachydactylurgy: light-fingered techniques applied to the enemy’s wastebasket. The cryptanalyst 
is never too proud to accept help from whatever quarter—and even Faust turned the tables on Mephis- 
topheles in the end. 

h. We have already shown a number of examples of the application of mathematics in recognizing 
phenomena. One of the useful mathematical tools for evaluating distributions, i.e., testing for ‘“‘goodness 
of fit’”’ against an assumed statistical population, is the x’ (chi square) test. The value of x’ is calculated 
ffir an)? 

ay 
pected frequency of each category in a distribution. The x’ value and the appropriate number of ‘‘degrees 
of freedom’”’ (symbolized by the Greek letter », nu) are then looked up in a table and translated into a 
probability statement. The number of degrees of freedom is usually c—1: thus for digital text »=9; 
for 26-letter text, »=25; and for teleprinter text, »-=31. In Fig. 178 is illustrated an abridged chi-square 
table that will be found generally useful in estimating the orders of magnitudes of probabilities. 


by the formula x?= > where f, is the observed frequency of each category and a, is the ex- 
y 
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(1) As an example of the application of the x? test, let us assume that we are to evaluate a distribution 
-of 180 digits of supposedly random text, i-e., from an equiprobable population; “ this distribution is 
shown in the column labeled f, of the diagram below: 


f, a, f,—a, (f,—a,)? 


0 22 18 4 16 
1 14 18 —4 16 
2 138 #18 —65 25 
3 18 18 0 0 
4 18 18 0 0 
5 17 18 —1 1 
6 16 18 —2 4 
7 #18 = 18 0 0 
8 17 18 —1 1 
9 27 18 9 81 


180 180 0 144 


The sum (144) of the squares of the differences, divided by the expected number (18), gives a x? value of 
8; this figure, looked up in the table on the row for 9 degrees of freedom, is found to represent a probability 
of something greater than 0.5. This means that if we were to examine 100 samples of 10-category random 
text (the sample size is for all practical purposes immaterial), slightly more than half of them would be 
as rough as or rougher than the distribution just studied—in other words, this distribution is indistinguish- 
able from a random one. Had the x? value for a distribution of digits turned out to be, say, 28, looking 
this up in the row for 9 degrees of freedom gives us a probability of .001; i.e., in 1000 samples of random 
text, only one of them would be expected to be as rough as or rougher than the case at hand. 


6 The sample is taken from the four message beginnings given in subpar. g(8), above. 
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Probability 

. 01 . 005 . 001 0001 .90001 . 000001 
6. 6 7.9 10. 8 15.1 19. 5 23.9 
9.2 10. 6 13.8 18. 4 23. 0 27.6 
11.3 12.8 16. 3 21.1 25.9 30. 7 
13. 3 14.9 18.5 23. 5 28. 5 33. 4 
15.1 16.8 20. 5 25. 7 30. 9 35. 9 
16. 8 18.5 22.5 27.9 33. 1 38. 3 
18.5 20.3 24.3 29. 9 35. 3 40. 5 
20.1 22.0 26. 1 31.8 37. 3 42.7 
21.7 23. 6 27.9 33. 7 39. 3 44.8 
23. 2 25. 2 29. 6 35. 6 41.3 46. 9 
24.7 26. 8 31.3 37.4 43.2 48.9 
26. 2 28. 3 32.9 39. 1 45.1 50. & 
27.7 29. 8 34. 5 40. 9 46.9 52. 8 
29. 1 31.3 36. 1 42.6 48.7 54. 6 
30. 6 32. 8 37.7 44.3 50. 5 56. 5 
32. 0 34. 3 39.3 45.9 52. 2 58. 3 
33. 4 35. 7 40. 8 47.6 54.0 60. 1 
34. 8 37, 2 42.3 49, 2 55.7 61.9 
36. 2 38. 6 43. 8 50. 8 57. 4 63. 7 
37. 6 40. 0 45.3 52. 4 59. 0 65. 4 
38. 9 41.4 46.8 54. 0 60. 7 67.1 
40. 3 42.8 48.3 55. 5 62.3 68. 9 
41.6 44,2 49. 7 57. 1 64. 0 70.6 
43. 0 45.6 51.2 58. 6 65. 6 72. 2 
44,3 46.9 52. 6 60. 1 67. 2 73.9 
45.6 48. 3 54. 1 61.7 68. 8 75. 6 
47.0 49.6 55. 5 63. 2 70. 4 77.2 
48. 3 51.0 56. 9 64. 7 71.9 78.8 
49. 6 52. 3 58. 3 66. 2 73. 5 80. 4 
50. 9 53. 7 59. 7 67. 6 75. 0 82. 0 
52, 2 55.0 61.1 69. 1 76. 6 83. 6 
53. 5 56. 3 62. 5 70. 6 78.1 85, 2 
54. 8 57.7 63. 9 72.0 79. 6 86. 8 
1 . 0 3 5 | 4 

3 . 3 . 6 .9 6 . 0 

7 . 0 . 0 ey} 7 7 

9 2 4 . 6 1 Ll 

0 7 4 5 .7 .4 

3 3 .8 8 8 1 

6 . 0 . 2 scl . 8 8 
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(2) Where the expected frequencies in each category are equal, it is preferable to use an 
equivalent formula for x?. This formula, especially advantageous when a desk calculator is handy, is 


. v=E 2f,?—N; thus, in the previous example wherein the sum of the squares of the frequencies is 3384, 


ea (3384) —180=8, as before.® In a similar situation involving 26-letter text, we have the follow- 


ing distribution to be tested on the hypothesis of an equiprobable universe: 


A 167 G 194 L 167 Q 189 Voo1%2 

B 171 H 152 M 165 R 138 W 159 

c 189 I 146 N 137 S 172 xX 179 

D 4152 J 162 0 150 T 187 Y 4174 

E 141 K 154 P 182 U 163 Z _185 

F 159 4306 
4306 





The expected (average) frequency for each letter is or 165.62, rounded off to the nearest hundredth, 


26 
and the squaring of the (f;—a,) differences would be a little clumsy. Instead, we calculate the sum 
ie (719,934) —4306=41.0 which, as 
may be seen in the table (in the row of 25 degrees of freedom), roughly interpolating by eye between 37.7 
and 44.3, means a probability of about .02, i.e., only one random sample in 50 will have a score as large 
as or larger than 41.0. 

(3) We shall now treat a case wherein the expected frequencies are not equal. Let us assume that 
the following cryptogram has been recognized as being a transposition cipher, but that the language 
of the underlying text is unknown, perhaps either English or German: 


(719,934) of the squares of the frequencies, and compute X*= 


ITANM IETNA ICTGV IRCHN PESMS LECNE EDAST LDEIM ROSWD RAMEM 
SNPEO ETTEP VENAE WHNNI TEONO TESWD SAAED EMEMT MPOTA RRTOT 
EXEDE WNEAF GMAEN NRBEA EIFTR RDNFA ELEAB HAOIE URIOF DPDSO 
PLMHR IAODM MIPFM THIZA ERRTC AERLT EAISS IATAN SSNTY SEOET 
CTEIH TSALO ONUVI EDIRV NIIIL THNDO CHTCN ZOLEE NTTIR BEPAE 
ERTIS MNCTS LRHVG GMSSE IMNOE OOSOA EUTHP 


z 

z 

z 5 
= z = = z 
z z z ~zZ#8 =z 
z =z z zzz zzz 
2 BZ zz SZ22S5 222 
ZB2222522 Z2BZZR ZBARTPZFBP rs 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


The expected frequencies for a given language are obtained by multiplying the probability of each letter 
by the sample size; thus, if in English the letter A, has a probability of .0737, then we should expect 
.0737 X285 or 21.00 A’s in our sample, and so on. In Fig. 179, below, are listed the computational steps 
in testing the distribution under the hypothesis that the cryptogram is transposed English plain text, 
and in Fig. 180 are these steps under the hypothesis that it is transposed German plain text; the “Sq” 


** The most convenient sequence of operations for obtaining the values for x? and 6 I.C., when a desk calculator is 
available, is to derive the y IC. first, as follows: 
czf? 
GQ) y= Nw 
(2) =N(y—-1) 


_17 ,Mtlee e+N—c 
(3) s=1+H] » or Wa 
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in the column headings means of course (f,—®a,)?. The x? of 34.69 with 25 degrees of freedom for the 
English hypothesis, representing a probability of 0.1 is not a bad fit, while the value of 105.54 shows that 
German plain text is astronomically out of the question. We must, however, take another look at our 
computations. The test is prone to error when the expected frequencies in some categories are too small 
(look in particular at the contribution of 10.57 for Z in Fig. 179). What we should do is lump together 
these categories which fall below a preselected level, adjusting the number of degrees of freedom accord- 
ingly; here we shall combine the probabilities and observed frequencies of those letters whose expected 
frequencies are less than 2.00: 


P(E) f; ae P(G) f, a, 
J .0016 — (0.46) J .0032 — (0.91) 
K .0030 — (0. 86) Q .0001 — (0.03) 
Q .0035 — (1.00) X .0002 1 (0.06) 
X .0046 1 (1.81) Y .0004 1 (0.11) 
Z .0010 2 (0.29) 0039 2 
.0137 3 


These combined entries are now substituted in the calculations, as shown in Figs. 179a@ and 180a in the 
lines labelled ‘‘&”’. It is seen that the value of 22.43 (now with 21 degrees of freedom) for the hypothesis 
of English plain text is much improved (probability of 0.5), and it can be shown (with more extensive x? 
tables) that even the x? of 83.49 with 22 degrees of freedom has been improved by a factor of 1000 to a 
still useless 0.00000001. (Note, by the way, the high score contributed by the letter M: there happens to 
be an inordinate number of M’s in the plain text, many more than would be expected in an average 
sample of the language.) 
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NK MEd GHAR RMOWOZEYr Roe tase dWOnD 


P(E) 


. 0737 
. 0097 
. 0307 
. 0424 
. 1300 
. 0283 
. 0164 
- 0339 
- 0735 
. 0016 
- 0030 
. 0364 
. 0247 
. 0795 
. 0753 
- 0267 
- 0035 
. 0758 
- 0612 
- 0919 
. 0260 
- 0153 
- 0156 
. 0046 
. 0193 
. 0010 


1. 0000 


wee 


285 


8; 


ee 
a 
S 


285. 00 


Figure 179 


f;—a, 


2. 


—0. 


—0 


0. 


00 


75 


. 08 
. 95 
—3 
—0. 
. 34 
. 05 
—0. 
—0. 
-1. 
. 96 
—0 
—2, 
. 39 
-1. 
—4, 
- 56 
.8i 
—4, 
. 64 
—0. 
—0. 
—4, 
-71 


07 
67 


46 
86 
37 


66 
46 


00 
60 
4) 
45 


31 
50 


00 


nN 


iw] 


— 


oe 
nSeocosensoegoSeosoesoesoocos 


Sq 


00 
06 
56 
01 
50 
42 
45 
12 
20 
21 
74 
88 
28 
44 
05 
93 
00 
16 


28 
45 
41 
20 
10 
25 


92 





woseeneserssrs = SEPePeersssss 
rs 
Oo 


NK MSM CHRADOVOZEOR oH MODs ETOP 





P(G) f; a, f;—a, Sq 8q 
ay 

. 0600 23 17. 10 5. 90 34. 81 2. 04 
. 0170 3 4. 85 —1. 85 3. 42 0.71 
. 0270 8 7.70 0. 30 0. 09 0. 01 
. 054) 12 15. 42 —3. 42 11. 70 0. 76 
. 1795 42 51. 16 —9. 16 83. 91 1. 64 
. 0160 5 4. 56 0. 44 0.19 0. 04 
. 0320 4 9. 12 —§, 12 26. 21 2. 87 
. 0413 10 11.77 —-1.77 3. 13 0. 27 
. 0813 23 23. 17 —0.17 0. 03 0. 00 
. 0032 ae 0. 91 —0.91 0. 83 0. 91 
. 0124 —_ 3. 53 — 3. 53 12. 46 3. 53 
. 0331 9 9. 43 — 0, 43 0. 18 0. 02 
. 0226 16 6. 44 9. 56 91. 39 14, 19 
. 1055 22 30. 07 — 8. 07 65. 12 2.17 
. 0272 19 7.75 11.25 126.56 16. 33 
. 0083 9 2. 37 6. 63 43. 96 18. 55 
. 0001 —_ 0. 03 — 0. 03 0. 00 0. 00 
. 0723 \7 20. 61 —3. 61 13. 03 0. 63 
. 0687 19 19. 58 —0. 58 0. 34 0. 02 
. 0574 28 16. 36 11.64 135,49 8. 28 
. 0458 3 13.05 —10.05 101.00 7. 74 
. 0087 5 2. 48 2. 52 6. 35 2. 56 
. 0150 4 4. 28 — 0. 28 0. 08 0. 02 
. 0002 1 0. 06 0. 94 0. 88 14. 67 
. 0004 1 0. 11 0. 89 0. 79 7.18 
. 0109 2 3. 11 —-Lil 1. 23 0. 40 
1. 0000 285 285. 02 0. 02 105. 54 


Figure 180 





968 


od 


enxx¢MSd awe RPoOonoazsZe Aeon mMOmsrooOnm> 


P(E) 


. 0737 
. 0097 
. 0307 
. 0424 
. 1300 
- 0283 
- 0164 
. 0339 
. 0735 
. 0016 
. 0030 
. 0364 
. 0247 
. 0795 
. 0753 
. 0267 
- 0035 
0758 
+ 0612 
. 0919 
. 0260 
» 0153 
. 0156 
. 0046 
- 0193 
- 0010 
. 0137 





1. 0000 


f; 


285 


a; 


21. 00 
2. 76 
8.75 
12. 08 

37. 05 
8. 07 
4, 67 
9. 66 

20. 95 


10. 37 
7. 04 
22. 66 
21. 46 
7. 61 


21. 60 
17. 44 
26. 19 
7.41 
4, 36 
4.45 


3. 90 





284. 98 


f;—a; 


2. 00 
0. 24 
—0. 75 
— 0. 08 
4. 95 
—3. 07 
— 0. 67 
0. 34 
2. 05 


—1. 37 
8. 96 
— 0. 66 
— 2. 46 
1, 39 


— 4. 60 
1. 56 
1. 81 

—4, 41 
0. 64 

—0, 45 


—4. 50 
—0. 90 


0. 02 
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Sq 


00 
06 
56 
01 
50 
42 
45 
12 
20 


BPooSoF 


2 


POSS 


88 
28 
44 
05 
93 


reesr 


21. 16 
3. 28 
19. 45 
0. 41 
0. 20 
20, 25 


0. 81 


Sq 


ay 


19 


00 
66 
17 
10 
01 
20 


eseeseresesses 


18 
40 
02 


essere 


25 


98 
14 
13 
62 
09 
04 


eern»esce 


we 


68 


0. 21 





22. 43 


SNK KEM GANROVOAZSZH ACH Mes oOD> 


P(G) 


. 0600 
. 0170 
. 0270 
. 0541 
. 1795 
. 0160 
. 0320 
. 0413 
. 0813 
. 0032 
. 0124 
. 0331 
. 0226 
- 1055 
. 0272 
. 0083 
. 0001 
. 0723 
- 0687 
. 0574 
. 0458 
. 0087 
. 0150 
. 0002 
. 0004 
. 0109 
. 0039 





1. 0000 





f; ay 
23 17. 10 
3 4. 85 
8 7.70 
12 15. 42 
42 51.16 
5 4. 56 
4 9. 12 
10 11.77 
23 23.17 
_ 3. 53 
9 9. 43 
16 6. 44 
22 30. 07 
19 7.75 
9 2. 37 
17 20. 61 
19 19. 58 
28 16. 36 
3 13. 05 
5 2. 48 
4 4. 28 
(1) 
(1) 
2 3. 11 
2 1.11 
285 285. 02 


Figure 180a 


—3. 61 
—0. 58 
11. 64 
—10. 05 


—0. 28 


-111 
0. 89 





— 0. 02 


Sq 
34, 81 
11. 70 


83. 91 


26, 21 


12, 46 


91. 39 
65. 12 
126. 56 
43. 96 


13. 03 


135. 49 
101. 00 
6. 35 
0. 08 





ai 


04 
. 71 
01 
76 
64 
04 
87 
27 
00 


eSoNnereoeon 


3. 53 
0. 02 
14,19 
2.17 
16. 33 
18. 55 
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(4) One more example might be apropos at this point. If we wished to test the distribution of the 
4306 letters given in subpar. (2), above, for the possibility of a complex noncrashing encipherment, we 
-will have the following computational steps: © 


NKM SS CHMODOVOMZZS HK Re Hn Dot OW> 


P 


. 0370 
. 0396 
- 0388 
. 0383 
. 0348 
. 0388 
. 0394 
. 0386 
. 0370 
- 0399 
. 0399 
. 0386 
. 0390 
. 0368 
- 0370 
. 0389 
. 0399 
. 0370 
. 0376 
. 0363 
. 0390 
. 0394 
. 03894 
. 0398 
. 0392 
. 0400 


i. 0000 





f; 


167 
171 
189 
152 
141 
159 
194 
152 
146 
162 
154 
167 
165 
137 
150 
182 
189 
138 
172 
187 
163 
172 
159 
179 
174 
185 


4306 


a; f;—a; 
159. 32 7. 68 
170. 52 0. 48 
167. 07 21. 93 
164. 92 —12. 92 
149. 8&5 —8. 85 
167. 07 —8. 07 
169. 66 24. 34 
166. 21 —14. 21 
159. 32 —13. 32 
171. 81 —9. 81 
171. 81 —17. 81 
166. 21 0. 79 
167. 93 —2.93 
158. 46 —21. 46 
159, 32 —9. 32 
167. 50 14, 50 
171. 81 17. 19 
159, 32 —21. 32 
161. 91 10. 09 
156. 31 30. 69 
167. 93 —4, 93 
169. 66 2. 34 
169. 66 — 10. 66 
171. 38 7. 62 
168. 80 5. 20 
172, 24 12. 76 

4306, 00 0. 00 


(f;—a,)? 


58. 98 
0. 23 
480. 92 
166. 93 
78. 32 
65. 12 
592. 44 
201. 92 
177. 42 
96. 24 
317. 20 


113. 64 


162. 82 


(f;—a,)? 


ay 
37 


SEEPESEeFSONrroeNS Sree rwyesernynos 
© 
— 


Interpolating in the x? table for 25 degrees of freedom, we find that the value 31.68 represents a proba- 
bility of about 0.2; in other words, this is a good fit for the hypothesis of noncrashing encipherment. 

(5) We cannot leave this discussion without an admonishment on the application of mathematical 
tools. High scores in significance tests are regarded by the experienced cryptanalyst as indicative of a 
probability of a particular hypothesis, and not proof of the matter. Take for example the following 
440-character cryptogram sent by an enemy known to be using cyclic additive keys of lengths between 


20 and 40 digits: 


90723 78168 
51844 80725 
28147 15733 
66954 13321 
20894 16966 
11794 57837 
06260 72364 
55013 35800 
816535 45991 


6° The probabilities here are those given on p. 363, and have been calculated by the formula P;= 


94849 
95351 
58293 
61791 
09087 
24849 
91991 
92354 
26864 


15771 
25207 
45515 
T5797 
596354 
06800 
17821 
04365 
97686 


16844 
71062 
05206 
51414 
80149 
00520 
62194 
92886 
06029 


17454 
43897 
88337 
31979 
82880 
19613 
36516 
96225 
44327 


66220 
67340 
34666 
86210 
81862 
90147 
06329 
20858 
T4662 


88312 
60921 
19895 
85627 
TT4T0 
16045 
85610 
05926 
65027 


87103 
05986 
67818 
71095 
01320 
20150 
90458 
00264 


_ 
c-l’ 


45436 
85348 
09150 
58825 
13674 
35129 
05395 
38137 





Pi where P, is the 


probability of the cipher letter, p; the probability of the plaintext letter in the language, and ¢ the number of categories. 


Thus, since E, in English has a probability of .1300, the probability of Ein the cipher text is 


206-687 O- 77 - 26 


397 


1—.1300__ 
5 


== .0348. 
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The frequency distribution of the cipher text written out on a width of 20 is the following: 















12 3 4 5 @ 7 8 9 10 11 12 13 14 15 16 17 18 19 20 
0 2451123534 3 113 
1 225 2121712151243 
2 3 1214 21333 171 
3 3115311 1 242331 
4 6432213 31262 i111 
5 5 812342121371 #25 
6 1114244242631414 1 
7 2312153 1 114234 
8 3322111153 43611 
9 $3 143 3134223122 
68 58 60 66 46 58 74 42 40 52 48 68 46 60 52 54 68 52 68 46 =1126 


The 6 I.C. here is OREN a1? and its sigmage is ao Te 

This sigmage, which can be interpreted by the x’ distribution with 209 or 180 degrees of freedom, 
turns out to have a probability of 0.000005 of having occurred by chance in a random sample of this 
size.” This shows that we are certainly on the right track, but it doesn’t prove that we necessarily have the 
right answer. If we should write the cipher text on a width of 30, however, we will have the following 
distributional diagram: 








12 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 2 29 30 
0i932151 bi’ 324° i 2.2 Sai, 233° 24 
1} 1 #113 231164 25 31323 21221 
O66? Pe vs 1-12 2 51 

3 4 1127311 2 

4 312 13 2141 

5) 313 14 i 21 

626 22 53 1 332 

7 at <i 15312 2 

8] 1 2 54 231211 

91312 2 2 5 142 

80 42 36 40 30 28 30 64 24 28 32 40 24 32 12 

10(1020) 440(1.69-1.00) 1, 96 hig 


The 6 I.C.- here is 20(15-14) +10(14 13) > 1.69, while the sigmage is 1230.9) 
sigmage, on the x’? distribution with 309 or 270 degrees of freedom, can be interpreted and shown to 
have a probability of less than 10-* of occurring by chance. The explanation is that a cyclic 30-digit 
additive sequence was actually used with underlying monome-dinome text of a theoretical I.C. of approxi- 
mately 1.69; on a width of 20, however, each column of the distribution diagram is composed not of a 
random sampling of ciphertext digits, but instead represents a merger of three monoalphabetic distribu- 
tions, as is in fact suggested by the average I.C. of 1.22 for this array—almost exactly one-third the bulge 
of the underlying plain text. 


°? The manner of this computation, a bit complicated, is outlined here for the interested reader. Since the distribution 
of the 8 I.C. is asymptotically related to the x? distribution, the latter may be used to evaluate the 6 I.C. The mean of 
any x? distribution is equal to », and the variance (¢?) is equal to 2», which in this case is 360; the standard deviation 
(7), being equal to the square root of the variance, is in this case 7360 or 19.0. The sum of the mean (180) plus the product 
5.1X19.0 gives the equivalent x? score of 276.9. Now the probability that a x? score equal to or greater than & will occur 





is given by 1 minus the Poisson cumulative entry for 3 where 5 is expected. Thus, in this particular case, we look up 
a = = (rounded off to 138) in the Poisson cumulative tables, and opposite the expected value — or 90 we find the 


entry .999995, which when subtracted from 1 gives the answer 0.000005. 
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(6) A typical example of the use of log weights in substitution ciphers has been treated in subpar. 
76q(4) in connection with the selection of generatrices. Log weights are also useful in the solution of 
transposition ciphers, as will be shown by the subsequent discussion. Let us suppose that we have at 
hand the transposition cipher given in subpar. h(3), above, and that it has been recognized that the under- 
lying language is English. The message length, 285 letters, suggests the possibility of a completely filled 
rectangular matrix, either 15X19 or 19X15. If this assumption is correct and if the usual form of keyed 
columnar transposition is involved, we can determine the size of the matrix actually used. This we do by 
inscribing the cipher text into the matrices by columns from left to right, counting the vowels in the 
rows and noting the deviations from the expected. The correct matrix size will exhibit a consistency of 
smaller deviations from the expected 40% vowels; the sum of the deviations, divided by the column 
lengths, gives a convenient index pointing to the correct matrix from among several possibilities— 
the correct matrix will be the one with the smallest index. In Fig. 181, below, the expected number of 


vowels in each row is .40X15=6.0 and the index is 270 = 1.4, whereas in Fig. 182 the expected number 


is .40<19=7.6 and the index is ve 1.0; it is obvious that Fig. 182 is the correct matrix. 
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The columns of the matrix of Fig. 182 are correct; only their order remains to be determined. Unless 
col. 1 is the last column of the matrix, it must be followed by one of the other columns, which may be 
determined by considering the sum of the log weights of the digraphs formed by the 18 pairings shown 
below: * 


12 13 14 16 ‘16 17 18 19 110 

II -- IE 59 IR 73 IV 72 IT 73 IM 53 IW — IE 59 IH -- 
TR 64 TD 45 TA 74 TE 91 TE 91 TP 25 TN 48 TI 82 TA 74 
AC 61 AA 33 AM 61 AN 89 AS 80 AO 25 AE 13 AF 38 AO 25 
NH 38 NS 71 NE 87 NA 72 NW 33 NT 93 NA 72 NT 93 NI 51 
MN — MT 25 MM S59 ME 72 MD 13 MA 78 MF 13 MR 25 ME 72 
Ip 48 IL 70 IS 78 IW — IS 78 IR 73 IG 67 IR 73 IU — 


TS 67 TE 91 TP 25 TN 48 TA 74 TT 67 TA 74 TN 48 TI 82 
NM 42 NI 75 NE 87 NN 51 NE 87 NO 66 NE 87 NF 53 NO 66 
AS 80 AM 61 AO 25 AI 64 AD 73 AT 83 AN 89 AA 33 AF 38 
IL 70 IR 73 IE 59 IT 73 IE 59 IE 59 IN 92 IE 59 ID 45 
CE 76 CO 80 CT 61 CE 76 CM 13 CX — CR 38 CL 42 cP — 
TC 45 TS 67 TT 67 TO 84 TE 91 TE 91 TB 33 TE 91 TD 45 
GN 33 GW 13 GE 61 GN 33 GM 13 GD 13 GE 61 GA 48 GS 33 
VE _87 VD _— VP _— VO _13 VT _13 VE _87 VA _45 VB_— VO 13 

792 851 916 886 869 907 793 B32 638 


58 The weights used here are the digraphic weights (to the base 224) given in Table 15 of Appendix 2, Military Cryp- 
analytics, Part I. 


m—EORET= 400 





VM _— VT_13 VY _— VO _13 VL_-- VE_87 VS _— VE _87 VP _— 
673 865 789 843 852 1029 764 894 807 


The high score of 1029 for the pairing of cols. 1-16 shows that these columns are correctly juxtaposed. 
We could now continue the process, finding which column should be to the left of col. 1, and which column 
is to the right of col. 16, and in the end we would establish the order of all the columns, even if we had 
but a minimum background in the language.®® 

t, As a final word on the recognition of nonrandom phenomena, it must be stressed that diagnostic 
examination in the initial phases should rely heavily on powers of observation, rather than calculation; in 
particular, the spotting of bust messages and other errors, which has often been the crux of the first en- 
try into a new cryptosystem, is more readily done by eye than by statistical analysis or machine methods. 
Nevertheless, machine aids can and do make valuable contributions to diagnosis, especially in performing 
much of the clerical and statistical work incidental to the study of a new cryptosystem. One of the basic 
exploratory (or so-called ‘‘diagnostic”) machine programs is called the STETHOSCOPE program, for 
obvious reasons. The particular computer on which it is run may change as time goes on, but in essence 
the program presents a variety of fundamental information about a single message (or a single stretch of 
key) under study, as follows: 


a. The uniliteral frequency distribution, the monographic I.C., and its sigmage. 

b. The over-all digraphic I.C., as well as the digraphic I.C.’s on cut “A” and cut ‘‘B” and 
their sigmages. 

c. The over-all trigraphic I.C., and the trigraphic I.C.’s on cuts “A”, “B’”, and “C” and 
their sigmages. 

d. The local roughness (in terms of the observed and expected number of hits, and sigmage), 
when the message is offset against itself at offsets of 1 to 33. 

e. Width tests, giving average columnar IJ.C.’s and sigmages of the message if it were 
written out on widths from 2 to 51. 

f. The observed and expected number of tetragraphic and pentagraphic repetitions, and 
their I.C.’s and sigmages. 

g. A listing of polygraphic repetitions of length 4 or longer. 

h. If desired, the same categories of statistical information on the delta stream. 


The STETHOSCOPE program exists in several versions, including one in which several messages may 
be treated together ; its general purpose remains the same, as in a doctor’s first examination of a patient.”° 


6° A modification of this general procedure is adapted in machine methods for the solution of transposition ciphers with 
incompletely filled matrices, whether or not the number of columns of the matrix is known. 

7 The reader might be interested in examining a work entitled ‘““Cryptanalytic Diagnosis with the Aid of a Computer— 
a Collection of 147 STETHOSCOPE Listings” which I prepared for use in my Intensive Study Program in General Crypt- 
analysis. This anthology is derived from cryptographic examples embracing a wide variety of manual and machine 
cryptosystems, many of which are diagnosable from the STETHOSCOPE listing. 
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78, Third step: interpreting the phenomena.—a. The third step in diagnosis, that of explaining the 
nonrandom characteristics or manifestations once they are recognized, is the most crucial step in the 
diagnostic process; as indicated in subpar. 726, this takes experience and imagination, and, in addition, 
intelligence. In some cases interpretation will be practically synonymous with recognition: a striking 
roughness in a literal cryptogram, together with the presence of a plethora of polygraphic repetitions 
whose lengths look not unlike those expected for plain text, identify the message as simple substitution. 
Even in a more complicated system, interpretation may follow directly on the heels of recognition. In 
the following example from a pre-World War II course in cryptanalysis, it is given that the plain text 
is a message famous in English history: 


255 269 8635 261 471 958 220 370 4 21 20 25 


Although very short, the message can be easily and quickly solved by inspection, and the nature of the 
cryptosystem determined. 

b. Specific guidelines for the interpretation of nonrandom phenomena cannot be formulated: 
the cerebral gifts with which the analyst has been endowed will have to suffice—and the pooling of such 
gifts, especially in a particularly difficult problem, is to be encouraged and indeed may be absolutely 
necessary. Nevertheless, there are some generalities which bear restating. Certain distributional profiles 
can be easily identified for what they are (cf. subpar. 77e on pp. 360-367), and their interpretative 
exploitation may follow. Even when a rough distributional profile itself cannot be interpreted, nevertheless 
when there are changes in the distributional profile this signifies a key change, i.e., it denotes the begin- 
ning of a new cryptoperiod. Phenomena connected with certain bust or isolog situations may likewise 
be easily interpretable. The presence of depths shows that the key is not influenced by the plain or 
cipher text during the course of encipherment, and the presence of polygraphic repetitions in excess of 
those expected at random automatically excludes certain major classes of systems.”! The presence of 
isomorphs which exhibit properties of indirect symmetry of position and which can be chained out to 
yield a complete sequence, identifies the system as one involving sliding components and Vigenére 
properties. 

c. The absence of certain letters may yield interpretable information. An absent J may be indicative 
of a small-matrix digraphic system, or it may be another 25-letter system such as a 5X65 fractionating 
system, or a code in which there is no J in the code groups. If a missing letter is K, Q, W, X, or Z, this may 
point to a code (especially a commercial code) since permutation tables for codes have been constructed 
with one of these letters missing. On the other hand, messages containing, say, only the letters A through 
O merely mean that 15 letters have been employed, just that: the system might be a code system, or some 
type of multiliteral cipher. If the cipher text consisted only of consonants, without the 6 vowels, the 
system could be either a code or a multiliteral cipher—but even a digraphic system could not be excluded 
(cf. the system illustrated on pp. 387-391 of Military Cryptanalytics, Part I.) 

d. Certain types of aberrations, isologs, and other special situations in transposition ciphers lend 
themselves to facile interpretation, as will be shown by the examples below. 

(1) For the first case, let us study the following message: 


= 
4g 
le 


ESOOT ULOCO MENAT FMTVZ, 
NVDWL HARWC LMEIE OPINO ESNDG OTTEI 
FWROF RTNOW TPTIT CGAMH EEJIC NETOS 
LLMTV ZNVDE LRTEF 





The presence of a 7-letter ciphertext repetition, and the location of these segments in the message, point 
to an error involving a repeated column of the matrix in a keyed columnar transposition cipher. The 
column lengths involved are 7 and 6: there are 7 letters in the repeated column; there are 6 letters fol- 
lowing the second occurrence of the repetition; and there are 26 letters (26=27+2 6) preceding the 
first occurrence of the repetition. Furthermore, since the interval between the two repetitions is 59, 
the only sum of integral multiples of 7 and 6 possible is 5<7+4X6; thus there must be a total of 9 long 
columns and 7 short columns in the matrix of 16 columns. 


™ Careful judgment must be exercised in arriving at conclusions: as an illustration, the presence of long polygraphic 
repetitions in the cipher text of messages would not exclude, for example, one-time key based upon running plain text from 
a book. 
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(2) For the next example, the following two messages are to be studied: 


Message ‘“‘A”’ 
HINDR WOMSM ACPEG EABIR ELTAN ILWFEB 
SEAPO CTRUH NOTLF IPNEA TALFD OTVCS 
NIEET LEBLL LITEQO 

Message ‘“B” 
HINDR WOMSM ACPEG EABIR ELTAN ILWFB 
SEAPO CTRUH NOTLF IPNEA TALFD O(GFEE 
ENTMY NNOTVCS NIEET LEBLL LITEO 


The two messages are identical except for the insertion of 10 letters in Message ‘‘B” starting at the 57th 
position. Had these 10 letters been in two complete groups, it could have merely signified that these 
groups were inadvertently dropped in Message ‘‘A”’ by the transmitting operator; but in this context, 
it shows an omitted column of the transposition diagram, and that one column length must be 10. The 19 
letters following the interpolated segment in Message ‘‘B” shows that there must be one long column 
of 10 and one short column of 9 letters there; and the 56 letters (66=2X10+4%9) prior to the inter- 
polated segment must consist of two long columns and four short columns, making a matrix of 9 columns, 
four of them long and five of them short. 


(3) For the third example we have the following pair of messages isolated for study: 


Message ‘‘A”’ 
TTOTE OTPLG FSDRR RUSNH AJWLA EUBFB 
TOMTH NMTER AGARO OIYEH EHMEY SNRER 
UHNOS IREAR 

Message ‘‘B”’ 
OMTHN MTPLG FSDRR RUSNH AJWLA EUBFB 
TTTOT EOTER AGARO OIYEH EHMEY SNRER 
UHNOS IREAR 


This is clearly a case of a pair of transposed columns in a keyed columnar transposition cipher, and the 
number of letters between the two underlined segments, 24, points either to four columns of 6 letters 
each, or three columns of 8 letters each; but the number of letters after the second underlined column, 
32, points to the latter case; thus in the matrix of 9 columns there are seven long columns of 8 letters, 
and two short columns of 7 letters. 


(4) The next case deals with the repetitive phenomena present in the following two messages: 



































Message ‘‘A”’ 
NOSMO BOOOI TEARS PRDEO EPOOL GNTIF 
EUUNS TLATT ATODO LYIBR ARLIM CTIMC, 
GETRSE EMEAA YENCO FBPIO NYIIC NDSRY 
CCFAD TUGSE 

Message ‘‘B”’ 
NOSEA CLITC OITTFD NLEAT NDEOTIT LLWEC 
SDGNT ILALN EKNSI TETST EFETO DOMLS 
BSGOA RLCTT ERTOR MCTFI BTPRE JMEAE 
AAIOA SUOFB PMNUE EORIC NVYEI DAICFE, 
«AE EOA RPRI 
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These manifestations are the result of similar beginnings in a columnar transposition system. There are 
12 segments initiated by the underlined polygraphs, indicating 12 columns of the matrix; in Message ‘“‘A”’ 
the column lengths are 9 and 8, while in Message ‘““B” the column lengths are 11 and 10. Since the column 
breaks are known, anagramming of the texts is a trivial matter. 

(5) In this next example the manifestations admittedly would be hard to detect in a volume of 
traffic, but on detailed examination it is found that there is a large number of polygraphic repetitions in 
common between the two messages, spaced at a more-or-less uniform distance apart, but not preserving 
the same order of these repetitions in the two messages: 


Message ‘‘A”’ 
CYMRS TUHIT QOANB EOQDHE Dts) ETEOV, 
SSBERH EAVUE EQLED DDCRE I IALEN SRLOG 
RICNC 





MSRFH RENAS_ URAPN NAGIE oFEHN 
10 


he 
~ 


Message tas 
MTIUS RLROM IHEAE NP oe RYSNS RETEE 
4 


1 
ONAGR apse EEMDN RFHHE Ee ea SCVIF, 
6 
EHFFG STSDE F722 SNEUS OOATI PODEN 
“9 13 
NORST 


14 





These are the manifestations of a pair of messages in columnar transposition with similar endings, 
relatively offset in the bottom rows of the two matrices. Although the segments delineated by the repeti- 
tions could be anagrammed as in the case of similar beginnings, we are able by a special method of solu- 
tion to derive the transposition key directly, without recourse to anagramming (see pp. 425-427 of Military 
Cryptanalytics, Part II, for the solution of this example). 

(6) In another example of the interpretation of phenomena in transposition ciphers, let us study the 
following pair of messages: 





























Message “A”’ 
CNSDO MEDUT DMFLT FALSE ADOSI NALEO 
NUTVC ETIGO AFILS HWOAN EDAAT PASNT 
LAUOI MFLEE TLERL CIIYV NTNOI RRTMC 
NFSRG_IPELP ROIUC EESNL TEBSE ASICF 
Message ““B” 
CNSDO LEITM FLTAP ITGDO SWOCH NUTET 
FIOAL ETAIO ANPBA ENASN ALEDM FLENU 
OMHCI KNFNO IRRTI PTTGI PLRVO IUBTN 
ITTEB SROEG 


Although the repetitive phenomena present are reminiscent of similar beginnings in columnar transposi- 
tion ciphers, the lengths (2, 3, 4, 5, and 6) of the polygraphic repetitions in common are puzzling at first 
glance, since we expect them to be of lengths n and (n+1), barring accidental contacts which might cause 
an occasional fluke longer repetition. Furthermore, the column lengths of Message “A’’ appear to be from 
7 through 10 letters, inclusive, and those of Message “B” appear to be from 5 through 10 letters. A little 
thought on the subject, however, will lead us to the hypothesis that what is involved is a matrix with 
blank cells incorporated, and that these blank cells are placed near the beginnings of the columns (thus 
giving rise to the different-length repetitions). Solution of this case, then, would proceed by anagramming 
the ends of the 13 columns delineated by the repetitions. 
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(7) For the last example, let us consider a case which, although rarely encountered, serves to illus- 
trate certain interpretative considerations. The following message is being studied: 


TOROE REVST ENFOS RAIOU OSADY 
FGOVC RRSSI REFOI GPSIN NSPLP 
EAWIS ENDIN IVASL BEDOP TOLLA 
OFNOI ETLEV RRSTN ESSST ENENV 


ODIYP ESDTE IXPOS MOTOH BRCGA 
OESOA LANTL EVERE NSHEI LATST 
SASFO EATOE MATFI NEGIU RHTWI 
IRWOA NIRZU RNSEE OOONI OUPDE 


VONYO IOIVT RDIIT PSEWT NTEPW 
RVIOS TOONG HECTO WPROO PTHEM 


INDTO LMEMI SELLF ERTSW OCENI 
VEFCA KESIN REEDO STRXF ITSFU 
LLARD SSEER 


From its uniliteral frequency distribution, it has been determined that the message is an English-language 
transposition cipher, but initial efforts to anagram the text on the basis of single columnar transposition 
have proved fruitless. In further study of the cryptogram, we make a digraphic distribution on the cut 


and find the digraphic ¢ to be 178, so the digraphic 4 I.C. is le = 5.04; the digraphic ¢ off the cut, 
however is 110, so the digraphic 6 I.C. for this latter case is oro) —312. The situation is now clear: 


what we have is a case of digraphic transposition, in which each cell of the matrix contains a digraph 
instead of a single letter. The digraphic kappa plain constant for English is .0069, so the expected di- 
graphic I.C. is 676(.0069)=4.66; on the other hand, the I.C. of digraphs composed of disconnected 
letters from an English-language population, thus destroying the digraphic cohesion of the language, is 
676(.0667)?=3.01. On cut, then, this message displays the characteristics of English plaintext digraphs. 
Once the nature of the system is deduced, anagramming is much simpler than in the case of monographic 
transposition since we are dealing with larger units. 

(8) The foregoing discussion has been confined to manifestations in cases of monophase (i.e., single) 
transposition. The phenomena in double transposition are much obscured, and each case presents a very 
special case. In spite of casual references to the alleged existence of a test to be able to distinguish single 
columnar transposition from double, the truth of the matter is that no practical test exists.” The best 
way of distinguishing single columnar transposition from double is this: if it’s single, you solve it with 
ease, 

e. Proforma systems consisting of stereotyped messages in which the order and nature of the succes- 
sive elements are determined by prearrangement (as for example, weather messages) are identified as 
such by their very appearance. The specific type of proforma system may have to be determined through 
patent characteristics associated with certain types of traffic or through collateral information. Sometimes 
the problem of interpretation is simple enough to be solved without any extraneous information, as in 


7 This test is based on sliding the first several letters of a cipher message (i.e., those presumed to come from col. 1, 
the first numbered column of the matrix) and the last several letters of the message (i.e., those presumed to come from the 
last column of the matrix) throughout the remainder of the cipher text, and evaluating the digraphs thus formed, using 
log weights in a procedure similar to that illustrated in subpar. 77h(6) ; if the cryptogram is a single transposition, a certain 
mean score of four sets of log weights should be attained—but by this time we would already have solved the cryptogram. 
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the case of the following 14 messages given in their entirety, together with the intercept information 
enclosed in parentheses: 

(MIH DE FSE 1030 16 DEC) 04941 45401 02124 44464 44149 42401 
(MIH DE FSE 1044 16 DEC) 04942 48421 53625 46424 94244 46411 
(MIH DE FSE 1055 16 DEC) 04944 49421 53625 46424 94244 47411 
(MIH DE FSE 1119 16 DEC) 04040 40401 02124 44464 44149 41401 
(MIH DE FSE 1135 16 DEC) 04042 40401 02124 44464 44149 45411 
(MIH DE FSE 1154 16 DEC) 04043 46471 14724 44464 44047 42401 
(MIH DE FSE 1205 16 DEC) 04044 49421 53625 46424 94244 47411 
(MIH DE FSE 1229 16 DEC) 04141 42401 02124 44464 44149 42401 
(MIH DE FSE 1252 16 DEC) 04143 45471 14724 44464 44047 44401 
10. (MIH DE FSE 1307 16 DEC) 04249 40471 14724 44464 44047 43401 
ll. (MIH DE FSE 1314 16 DEC) 04249 47401 02124 44464 44149 41401 
12. (MIH DE FSE 1323 16 DEC) 04240 46421 53625 46424 94949 43421 
13. (MIH DE FSE 1342 16 DEC) 04242 45492 61215 46424 9424] 42401 
14. (MIH DE FSE 1355 16 DEC) 04243 47471 14724 44464 44048 49421 


This example, based upon a situation encountered during World War II in the Pacific Theater of Opera- 
tions, is capable of being solved in its entirety, in spite of the brevity of the messages and the small 
amount of traffic. 

f. We shall now take up the interpretation of phenomena in connection with indicators, and we shall 
use as an example one which may be considered typical of the approaches in such problems. 

(1) Let us study the following collection of Al and ZO groups (known to be the indicator and indi- 
cator-check groups) of 40 messages in an unknown cryptosystem: 


ODNDAARANDE 





1 ZO Al __Z0 
1 TXNEA XGFKH 21. DPGIM THPCK 
2. RFCWP GNGLV 22. RCYFW NOZVD 
3. AKPLM IZVRK 23. GSTBC PYIZE 
4. SGWFT INNEZ 24. KZHUX DOQBA 
5. ZEROM HWXGS 25. PAGSV ELPKG 
6. QIFWE GOOHM 26. MIYEQ HCZHT 
7. COKRZ LARUE 27. EATMR AIIXG 
8. LMDKG PAAIZ 28. MWQZG MAMZW 
9. AQXBI TLDMD 29. GEBOD XULCP 
10. TGZVE CEBPM 30. NBFHZ SMOKB 
ll. WMIUR DFHWZ Zl. YSKLQ IYRYZ 
12. BWUGE CPWNZ 32. COLTS BHSUE 
13. YAVLE VSEDZ 33. HBXSN OBDST 
14. RYKZE GSRLD 34. SHLDO UXSOX 
15. CREBX KSCDV 35. UNAZO WSKFW 
16. LXUYP CBWRS 36. FDMXU ODTRU 
17. KYMCA DGTBD 37. DTBWC GULQK 
18. VWEYM QZCFG 38. XURCA DGXOD 
19. OMTRD AXIHW 39. VNODU YCUFP 
20. ELDFT INASV 40. OVSHL SIYEF 


(2) The following information has been gleaned from an initial study of the traffic: 

a. The messages have flat counts, and polygraphic repetitions within messages are no more 
than those expected for random; but a high hit rate between certain pairs of messages proves 
that the cryptosystem is one in which depths are possible. 

b. The texts of message nos. 16 and 18 are in flush depth. 

. Message no. 38 is offset 30 positions to the right of message no. 15; and message no. 28 is 
offset 30 positions to the right of message no. 14. 

d. Message no. 37 is offset 60 positions to the right of message no. 31; and message no. 30 is 
offset 60 positions to the right of message no. 33. 

e. Message no. 6 is offset 90 positions to the right of message no. 3; message no. 16 is offset 
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90 positions to the right of message no. 39; and message no. 5 is offset 90 positions to the 
right of message no. 25. 

f. Message nos. 6, 13, 28, 30, 32, 34, and 35 have been determined from traffic analysis to be 
high-precedence messages. 


(3) It has been observed that there are no J’s present in any of the indicator groups, although 
there are J’s in the cipher texts of the messages. The Al group always consists of a set of five different 
letters; the over-all I.C.’s of the Al groups (0.97) and the ZO groups (1.01) are flat, as are the ten in- 
dividual columnar counts except for the Z0e which has an I.C. of 1.47. The only doublets present in the 
ZO groups are in the be position. Several instances of apparent digraphic relationships are seen between 
the Al and ZO groups (e.g., note the LM’s in the Al groups of message nos. 3 and 8 associated with IZ’s 
in the ZO groups), and it is observed that these relationships are reversible (e.g., note the CR in message 
no. 15 and the RC in message no. 22 associated with DV and VD). It is further noted that these digraphic 
relationships are confined to the first and last digraphs of the two indicator groups; it is therefore con- 
jectured that the last digraph of ZO represents an encipherment of the first digraph of Al, and that the 
first digraph of ZO represents an encipherment of the last digraph of Al, leaving the c position of Z0 
perhaps a monographic encipherment of the ¢ position of Al. The absence of the letter J, the lack of 
doublets in the ZOab and de positions, together with the reversibility feature, suggests Playfair; but 
encipherments such as the AK,=RK, in message no. 3 seem to require that the ZO groups be read in 
reverse before establishing equivalencies. with the Al groups. The Playfair hypothesis is quickly proved 
with the reconstruction of the square and the derivation of a key word on which it is based, and it is 
found that the ¢ position of Al is enciphered with the square by taking the letter to its immediate right 
in the row in which it is located. 

(4) The Alc position of the high-precedence messages consists of one of the letters A, F, L, Q, or V; 
these letters are 5 apart on the normal sequence (if J is omitted), and we might even conjecture that 
these letters come from the first column of a 5X65 square into which has been inscribed the normal 
sequence, less J. Is it possible that the Alc represents the precedence, and that the Jatter is based on the 
identity of the particular one of five columns (of such a square) in which the letter is found? Message 
nos. 16 and 18 which are in flush depth have the Al groups LXUYP and VWEYM; and since the indicators 
in a flush depth situation may be presumed to represent identical information, the letters in the c posi- 
tion, U and E, could come from the fifth column EKPUZ of our putative 55 square. These manifesta- 
tions in the c position may either be encipherments, or perhaps even more likely. some type of variants. 

(5) The existence of depths composed of pairs of messages offset at intervals of 30, 60, and 90 suggests 
that the keying sequence is in multiples of 30 (i.e., if a key book is involved, the pages contain lines of 
30 letters each), and that therefore the indicators designate the starting line used. If this hypothesis 
is correct, then the ab and de digraphs of Al could indicate the page and line, probably in that order. 
Then from message nos. 16 and 18 in flush depth with Al’s of LXUYP and VWEYM, it should follow that 
LX=VW, and YP=YM. The suggestion of variants is still strong, so perhaps Ala@é and de are digraphs 
representing single letters indicating page and line in a key book: thus the book might contain 25 pages 
of 25 lines each. If the interior of a 55 square is inscribed with the normal sequence, perhaps the row- 
and column coordinates of the bipartite variant square also consist of the normal sequence following 
some prearranged route. The urge is very strong to hypothesize the following coordinate configuration, 
in which the elements LX=VW and YP=YM are shown in ringed capital letters, the lower-case letters being 


soss® 
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In order to test what may seem to be a bold assumption, we consider a pair of messages, nos. 15 and 38, 
which are in offset depth 30 intervals apart on the keying sequence, with Al groups CREBX and XURCA: 
sure enough, CR=XU on the diagram above, and we find that BX and CA represent sequent positions 
(=30 letters in the keying sequence). A second test is in order, so we pick messages nos. 31 and 37 which 
are in offset depth 60 intervals apart, with Al groups YSKLQ and DTBWC: again on the diagram above 
YS=DT, and LQ and WC are two positions apart. We shallymake one final test to be triply sure, so we 
examine messages nos. 3 and 6 which are in offset depth 90 intervals apart, with Al groups AKPLM and 
QIFWE: AK=QT in the diagram, and LM is separated by three positions from WE. All the messages may now 
be correctly superimposed with respect to the keying sequence of 25X25X30=18,750 letters, keeping 
in mind the two possibilities that when the bottom of a key page is reached, the key is continued (a) 
from the top of the same page, or (b) from the top of the next page (perhaps with a proviso in the 
cryptographic instructions that a message should not be enciphered with keys starting past, let us say, 
the middle of page Z, the last page). 

(6) This example, although artificial, nevertheless contains complexities similar in nature to those 
of certain complicated indicator systems encountered in actual operations. Without sufficient material 
for study, and without the element of luck which is all too often essential to success, we might not have 
been able to complete the solution. Sometimes we are able to solve a problem in spite of errors in thought 
or procedure, and at other times we are able to reach a solution because of such errors.” As a demonstra- 
tion, we assumed in subpar. (4), above, that the indicators LKUYP and VWEYM must represent identical 
information, because the messages to which they appertained were in flush depth, and, encouraged by 
our findings, we went ahead and solved our problem. This is faulty reasoning, because the c position 
of the indicator (which happens to be a precedence symbo}) bears no relation to the page and line keys 
used in the encipherment, and thus the two messages in depth would not necessarily have the same 
precedence. Had the letters in the ¢ position of the two groups been, say U and 0, we might have argued 
ourselves out of the hypothesis being postulated and thus either delayed the solution, or missed it 
completely. Furthermore, although in the preceding subparagraph it was conjectured that Alad and de 
were digraphs representing single letters for the page and line indicators, these digraphs could just as 
well have represented as many as 25? pages and some number greater than 25 (say, 50, 75, or 100, with 
a variant usage) for the line designator. 

(7) As an epilogue to the discussion of interpretation of indicator phenomena, we should keep in 
mind certain situations which have arisen in operational practice. We must not overlook the possibility 
of cleartext indicators in various contexts with which we may be familiar, and extrapolations from fa- 
miliar contexts. The situation in subpar. 76f/(3) may be cited as an example, that of Hagelin C-38 
indicators in the clear which were interpretable at once from the five columnar distributions of the 
a-e positions of the indicator groups. If these indicators had been enciphered by five different direct or 
reversed standard cipher aJphabets, recognition and interpretation would hardly have been delayed. 
And even if the encipherment had been accomplished by five mixed alphabets, the severe limitation in 
the indicator positions representing the Jast two wheels would still enable easy recognition and interpreta- 
tion. In connection with cleartext indicators, we should also be on the lookout for an indicator in the 
clear every n groups of the cipher text (as in a case in which every 40th group was such an indicator 
for purposes of check on the encipherment). Tailing indicators are often easily interpretable under ap- 
parent or assumed rules of motion when the rules are not too complex, such as in certain pin-wheel 
devices or in certain varieties of notch control in wired-wheel systems. Null letters in indicators may 
be identified as such by finding indicators of messages known to be in flush depth, with a discrepancy 
in one of the positions; e.g., indicators of the form LDPCX and LDPCY in a machine cipher system could 


% The most striking example that comes to mind of incorrect reasoning making solution possible occurred many 
years ago during World War II, before the advent of computers, in a very complex teleprinter cipher system about which 
nothing was known. A long sequence of key was recovered from reading a depth, and, because of a totally unwarranted 
conjecture of the apparent limitation of two of the indicator positions to 23 and 25 letters, the key levels were written 
out on a width of the product of these numbers, 575. In this write-out, some long polygraphic repetitions were observed 
on successive rows, but displaced one position to the left, indicating a significant period of 574, not 575. Since 574= 14 4], 
the key levels were written on the prime width of 41; more polygraphic repetitions were found on this width, proving 
that the cycle of 41 played a part in the machine. Had it not been for the totally erroneous interpretation of the indicator 
phenomena, it is possible that the machine would not have been solved. 
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‘ suggest the possibility of four wheels and a null position.” Finally, literal systems have been encountered 





which have an underlying numerical base, such as in the simple scheme of A=1, B=2 . . . J=0, oras 
in the case of the three pairs of indicators and indicator-check groups shown below: 
Al A2 
1. MANUS CUDKI 
2. BGKHR VQARH 
3. ZUQMG PAGWQ 
These could have come from the variant values of the following diagram 
1234567890 
ABCDEFGHIJ 
KLMNOPQRST 
UVWXYZ 


Furthermore, given the order 1-0 for the digits in the top line, it is seen that the Al and A2 are both 
sum-checking groups, confirming this order. 

79. The treatment: hypothesis formulation and testing—a. In modern practice, cryptodiagnosis 
may be thought of as embracing hypothesis formulation and hypothesis testing. The establishment 
of a hypothesis is followed by a particular diagnostic test or set of tests, and their outcome will determine 
the validity of the hypothesis and the subsequent road to be followed. 

b. As an elementary example, in studying the 385-letter cryptogram given in subpar 77g9(6) with 
its accompanying on-the-cut digraphic distribution as shown below, 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 





Meat eo ta oe ee SOs) Dae eee 
Bi te: Or Ober ss A See ee BAB OUD Se en 
Cheri eee se DO ces ene ast es ee iz 
Dial Se inea Se ae oe eS 1 ia 
BiS2.5 Shere ee. SS DT Cees aie se ats fh hye 
Riise 08 eS eee ek i a ee 
Gla he ee oS ele 1. See Sue SE Le 
Histo Sothern udeteet ds po ects Dicks Me eee et eee sne 
T= See e CeS225 Deal SP eee Stee a 
SF ee ae Sean aie el ae Sea at pe Mane a es ae a ee a 
KS R oS See oe gs ee 
Bes ee Sd ee Se Sas Dee See 1S 
MA vicy tea Pe a  eet e s ee ae are 
NO oe ice ai WP ee es Be ee esd Ad 
Otek sees ose ee Die eh ake tte 1 os 
Ble Oi ee eh ee fener ae Pee ee iS 
Ge a, a ees eee ee eet a oh ye 25124 
Risse oe te ee eS eye Se eiS fa 9 24 
Sac Shs a ec nes ee eS eae tie cre 
PD Ses, a Ss ie eee ee eee 
Wi set Sh eee Sf, arcane vet ote 
Vie Se OS Sorevere eS Le hos ees oe ee 
West et eh ce os Das ee oh Teena 
Mca Re Totes hc, Set a, Be Natit eS AS il a ved a 
Mirren hte ee es Des, Se ane Des Oe Se eh Se eta 
Bie Aves tee, eee De hesiseak Be ea ks 








™ The possibility of variants should of course not be overlooked; one must also keep in mind that an apparent null 


or dummy position may not always be what it seems—it may be information extraneous to the keying, as was the case 
in the example in subpar. (4), above. For that matter, each indicator letter may control more than one keying element, 
so that each of the first four letters LDPC in the example above might be used to set a pair of wheels in a 8-wheel machine. 
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we were struck by (a) the absence of the letter J, (b) the lack of doublets, (c) the apparent matching 
propensities among the rows and columns of the distribution, and (d) the symmetry about the main 
diagonal. These characteristics lead us to the hypothesis of a bipartite system with a commutative matrix, 
and under this hypothesis we amalgamate the variant rows and columns of a 55 square, reducing the 
text to uniliteral, monoalphabetic terms with a satisfactory over-all 6 I.C., following which the plain 
text is recovered, proving the hypothesis. 

c. In another elementary example, if we have identified a cipher as being digraphic substitution and 
we wish to test it for the possibility of its being enciphered with an inverse four-square system,” all we have 
to do is to convert the cipher text with an arbitrary four-square matrix containing the normal sequence in 
the ciphertext sections and, if the hypothesis is correct, the distributions of the initial letters and of the 
final letters of the converted digraphs should exhibit the characteristics of monoalphabeticity.” 


-18 USC 798 
-50 USC 3024 (i) 
-P.L. 86-36 
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80. Post mortem.—a«. After a system has been solved (or for that matter, just as important, even 
if a system has not been solved), the diagnostic steps taken and a résumé of the work done on the problem 
should be properly documented. Technical reporting is all too often inadequate, in spite of the fact that 
it should be a major facet of cryptanalytic operations if the reports are to be of benefit to technicians, 
particularly the newer personnel.” In those cases wherein a system has not been solved, it is important 
to record the work which has been done, in order to evaluate the steps already taken, and to avoid 
unnecessary duplication if the problem is restudied later. In Fig. 183 is illustrated a suggested reporting 
form for unsolved systems which contains on a single sheet of paper a convenient résumé of the system. 

b. As mentioned in subpar. 74f, it is important that the cryptanalyst have readily available the 
salient cryptolinguistic data in the languages with which he is working. Among these data, the indispens- 
able items are the following: 


1. The frequencies of single letters, the monographic kappa plain constant, and the mono- 
graphic I.C. 

. The frequencies of digraphs, the digraphic kappa plain constant, and the digraphic I.C. 

The frequencies of initial Jetters of words. 

The frequencies of initial diagraphs of words. 

A listing of the most frequent trigraphs, with their frequencies. 

A listing of the most frequent initial trigraphs of words, with their frequencies. 

A listing of the most frequent tetragraphs, with their frequencies. 

The average length of words. 


OO ol Se Or ence be 


In addition to the foregoing, we should also have lists of frequent words and common phrases expected 
to be in the traffic, as well as a collection of representative samples of different types of messages. 


7 For suggestions on technical report writing, and for a model of a technical report, see pp. 386-391 of Military 
Cryptanalytics, Part I. 

78 See in this connection the compilation I prepared in 1956 entitled Letter Frequency Data, Foreign Languages, which 
contains the indispensable cryptolinguistic data, through tetragraphs in the following 20 languages: Albanian, Arabic, 
Bulgarian, Czech, Dutch, French, German, Greek, Hungarian, Indonesian, Italian, Persian, Polish, Portguese, Romanian, 
Russian, Serbo-Croat, Slovak, Spanish, and Turkish. 
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Reporting Form for Unsolved Systems 


* Kk * KE OK 












































1. Short Title: 2. Service Description: 
3. Time element covered: to 
4. Message volume: per week; per month; total on hand 
5. Msgssentin _—-lettergroups;__—-digit groups. Missing chars. : 7 
6. Discriminant: _ ; Indicator(s): 
7. Other nontextual groups: 
8. Possible indicator explanation: ; 
9. Evidence of tailing, trailing, or flush starts: 
10. Remainder test on msgs: 7 
11. Frequency counts: 
No. of Mono Dig Dig Dig 
Msg No. chars. IC. I.C. Cut A Cut B 
12. Width tests: 
Msg No. ; width ; av. depth sav. LC. 
Msg No. ; width ; av. depth sav. LC. 
Msg No. ; width ;av. depth sav. LC. 
Msg No. ; width ; av. depth sav. LC. 
13. Evidence of local roughness: - 
14, Positional roughness, group: 1 _ 2 3 4 5 
15. Phenomena in delta stream: 
16. Polygraphic repeats within msgs ; between msgs ; at beginnings : 
at endings ; in body of text 
17. Evidence of isomorphism: 
18. No. of flush depths ; offset depths ; maximum depth deep. 


19. Bust msgs: 
20. Analysts most familiar with system: 7 
21. Additional remarks (coded to item nos. above) ; related facts, collateral information (e.g., predecessor 
systems, probable type of system, traffic analysis observations) : 
Date: 19_~—s— Reported by: Org. 
Ficurr 183 











c. There is nothing like live traffic in an unknown cryptosystem to test one’s assimilation and 
understanding of diagnostic principles and techniques. If the traffic is in a low- or medium-grade system, 
diagnosis and solution should be a matter of course, given a sufficient amount of material for study. 
But even if the traffic is in a high-grade system, something can often be discovered in fairly short order, 
even if the magnitude of the discovery is not particularly startling—after all, a jigsaw puzzle consists of 
many pieces. For example, (a) the identification of buried indicator groups in certain positions of the 
messages, or (b) the recognition of probable machine-cipher traffic (implied by the level of correspondents 
and the volume of traffic passed) as Enigma from the over-all uniliteral frequency distribution typical 
of a noncrashing system, should be made quite early in the cryptanalytic game. In the meantime, or per- 
haps even as a concurrent exercise, the analyst would derive benefit and gain experience from participation 
in the Zendian Problem ” (especially if he worked as a member of a team °°), which provides considerable 


79 Cf. Appendix 8 (“The Zendian Problem: An Exercise in Communication Intelligence Operations”), Military 
Cryptanalytics, Part II. 
80 For example, as do the students in my Intensive Study Program in General Cryptanalysis. 


Seen 412 


“SPORES. 


practice both in traffic analysis and in the diagnosis and solution of the low-, medium- and high-grade 
systems contained therein. 
d. This chapter began with a definition; it is therefore fitting that we also end it with a definition: 


“‘diagnostician, n. An experienced cryptanalyst of ability, just before retirement age.” 


This is but a gentle reminder to the reader of an aphorism of Hippocrates, as translated by Chaucer: 
“The lyf so short, the craft so long to lerne.” * 


81 What Hippocrates actually said was 6 Bios Bpaxvs, } Se réxvn paxpy. 
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81. Special cases of aperiodic encipherment.—ca. This text has treated the principal methods for 
achieving aperiodic polyalphabetic substitution, which, from the standpoint of the cryptographic 
mechanics, fall into two categories: (1) systems in which the key elements are not in any way determined 
or influenced by any elements of the plain or cipher text; and (2) systems in which the key elements 
are generated or governed by the plain text being enciphered or by the resultant cipher text. Compli- 
cated operational examples have been encountered in each of these categories, and sometimes as a merger 
of the two categories. 

b. In addition to the monographic methods already treated, there are theoretically possible aperiodic 
digraphic substitution systems, paralleling the periodic digraphic systems illustrated in the preceding 
text.! For example, in a scheme involving a plurality of Playfair squares generated from a basic square 
such as the following,’ in which a permutation is accomplished two columns at a time by inscribing the 
five initial row digraphs of a square vertically into the two columns to the right of each succeeding 
generated square, 


Arac<r 
<sHOoO2zy 





producing the following band of 25 squares: 


Ss AAC Le 
<so7r K 
> BAVOQAOwH 
HOR |QW 
a NNW Po 
ArcrKtt 
eo S40 24 WM 
RQAHDWY 
3 MBOURe 
=~ wtpS 
> ANrNCGe 
onmn2U0 
Ss QaAaARHA 
OtuvPxz 
Crnumwos ZMH SBWo 
rouuyc 
£f OMWN Zo 
QraAaxH 
cocoa w 
OwHsMaN 


semen ccwns ee nn enn =--4 


wmrsaurs onrt<cvs 
THe ye F QOP RAs 


—OWNO = 
OHxsMAMN 
ArRaN 
WI U4 
maacoc 
NaQw Ss 
OWKHO M 
w URAIN 
PAwe 
cqnozt<s 
Amo AaQ|aQ 
HHON MM 
AOU = 
war< 
S2NaAKQD 
HAH ro 
vw< <= 
ZOGONPQ8 FPevuse Me 
s=qQoor 
NEPOo 


! Chapter XIII, Military Cryptanalytics, Part IT. 
2 Cf. subpar. 91c, Military Cryptanalytics, Part IT. 
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These squares, used sequentially, would yield periodic polyalphabetic substitution with a period of 25 
diagraphs; but the band of squares may be used in various ways to produce aperiodic encipherment. 
For example, in a plaintext interruptor system with E, as the interruptor letter, whenever E, occurs as 
the first letter of a digraph,* a double skip in the otherwise normal key progression could take place. In 
the illustrative encipherment below, we have used the foregoing Playfair band, starting in square no. 1 
with E, as the plaintext interruptor: 


Square no.: 1 9 10 1 12 13 14 16 17 18 
Plain: EN EM YP AT RO LS AC TI VE IN AR EA WE ST OF. 


Cipher: NT ZU WH WA EN UD CI NE AB DX HA BT LV HD GU 


Or, in a plaintext autokey variation, the second letter of the plaintext digraph could designate the particu- 
lar square (identified by the letter in the upper left-hand corner of the square) for the next encipherment; 
e.g., the ‘“‘A’’ square is square no. 3, the ‘“‘B”’ square is no. 8, and so on. This is illustrated in the following 
example: 


Square no.: 1 9 19 10 12 20 11 23 7 17 25 3 12 
Plain: EN EM YP AT RO LS AC TI VE IN AR EA WE ST OF . 


Cipher: NT AE PD OE CL OW OT PE HV FQ ET FE LX HD QA 


Ciphertext interruption and ciphertext autokey could be accomplished in a similar manner. An added 
complication would be to predicate the keying, not on a single letter, but on the mod-25 sum (as measured 
on the normal A-Z sequence, less J) of both letters of the keying digraph. Thus, in the example below, 
the second digraph is enciphered in square no. (E+N=5+13=18), the third digraph is square no. 
(E+M=5+12=17), the fourth digraph in square no. (Y+P=24+15=14), and so on: 


Square no.: 18 17 4 1 22 2 
Plain: EN EM YP AT RO LS AC TI VE IN AR EA WE ST OF ; 
Cipher: NT OE PD TP SR ZL DY CO GV UP GZ OW SM LP QA 


This latter scheme could yield ciphers of considerable complexity, as would the use of a very long literal 
key (with J either being ignored, or combined with I), such as in the following example: 


Square: w H E N I N T H E Cc oO U R 8 E 
Plain: EN EM YP AT RO LS AC TI VE IN AR EA WE ST OF . 

Cipher: XP FE PD CA EN SX OT WU GV UP US QS TG NP WU 

c. Many types of aperiodic substitution systems initially appear very complicated or difficult in 
their cryptanalysis, but, as we have seen from our studies thus far, methods for their solution become 
readily available or demonstrable.* Even in apparently more abstruse cryptographic cases, methods for 
their solution can readily be postulated. We shall now take up two illustrative special cases. 

82. Analysis and solution of a first case.—a. For the first example of what at first blush appears to 
be a complex case of aperiodic encipherment, we shall treat a cryptosystem that once occurred to the 
author in a dream after a particularly sumptuous meal.’ In that dream there came to us the principle for 


3 For that matter, an E, in either position of a diagraph could be used to govern the key interruption. 
4In this connection, the following quotation may provide some food for thought: 

“It has been said, with regard to musical problems, that musicians generally give the correct answers sup- 
ported by illogical argument, but mathematicians arrive at incorrect answers through a piccess of irrefutable 
reasoning.” 

—A. L. Leigh Silver, in The American Mathematical Monthly, Vol. 78, No. 4, April 1971. 

From this can be extrapolated that the intuitive cryptanalyst may hit upon a solution for reasons that are entirely irrele- 
vant, whereas a mathematician may correctly define the steps in a problem, predicated however on initial assumptions that 
later prove to be invalid. 

5 This story, including complete details of the meal which gave rise to the dream, is written up in an article entitled 
“A Cryptanalyst’s Nightmare: An Oneirotic Problem and Its Solution,” appearing in the NSA Technical Journal, Vol. 
XVI, No. 4, Fall 1971. 
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a cipher machine, a principle startling in its simplicity and yet apparently devilishly difficult in its 
cryptanalytic aspects—a machine incorporating sliding components with both plaintext and ciphertext 
autokeying in its cryptography. In this system, the first letter of the message plain text is enciphered by a 
key letter designated by an indicator; after that, every subsequent plaintext letter is enciphered by a 
key letter which is the mod-26 sum of the immediately preceding plaintext letter and its ciphertext 
equivalent. Thus the system would embrace all of the nasty features of plaintext and ciphertext auto- 
keying, and none of their {for the cryptanalyst] welcome attributes: polygraphic repetitions, which are 
plentiful in plaintext autokey, are here drastically reduced; and isomorphs, which arise in ciphertext 
autokey, should here be nonexistent. If the introductory key consists of several letters, there is no statis- 
tical way of determining its length, and other mathematical techniques applicable in autokey systems 
are fruitless here. A veritable cryptanalyst’s nightmare! 

b. But let us approach the subject calmly: after all, there must be some solution, albeit for a special 
situation. Let us consider the trivial case of known components and examine what happens in the follow- 
ing message enciphered with direct standard alphabets: 


6 21 22 9 2611 8 11 26 9 14 23 6 17 20 1 14 «19 22 7 24 1 2 5 
K: MFUVIZKHKZINWFQZANSVGXKBE 
P: WHATISYOURPRESENTPOSITION 
Cc: IMUOQRIVEQXEAXUMTCGNOQSPR 


The first plaintext letter, W,, enciphered in the initial key of Mx yields I, as the cipher equivalent. The 
second plaintext letter, H,, is enciphered by the mod-26 sum (=6=F;,) of the preceding W, and I,, 
yielding M, as the result. The third plaintext letter, A,, is enciphered by the mod-26 sum (=21=Us) of 
the preceding H, and M,, yielding U,. And so on. 

c. Now if all we had were the ciphertext message and a knowledge of the general system, we could 
make trial decipherments on the basis of direct standard cipher alphabets. In the three diagrams below, 
we have assumed that the first plaintext letter is A, B, and C, in turn, and we have deciphered the first 
five letters accordingly: 


10 17 26 5 116 1 4 1215 2 3 
K; JQZE K PAD LOBC 
Cc: IMUOQ IMUOQ IMUOQ 
P: ADEPM BCFON CBGNO 


“SEGRE. 


Noting the alternation of progression of the 1st, 2d, 3d. . . letters of the decipherments, we construct from 
the first “decipherment” a generatrix diagram in which the sequence in the even columns runs in the 
opposite direction from that of the odd columns, as follows: 


DTAWPNKH KH EK CHNAOVOSZBAORKRGH ROA BIC 
OANA CKH SHKHNPFWQOIABDOQOHGAKESZSZOvVsO 
CRGHILHQIAIWVAQWPNK KM SS CHNWOVOAE 


* 


Ne MS CHNWOVAOZRZOPRGCHLCAQAMVAWYS 
MAMQDMHAaARATRAOVODAVNVHA CA SHMHKNPW}QYS 


The message plain text comes out on one generatrix, as is indicated by the asterisked row. 

d. The foregoing case was patently trivial, the components being known. If, however, the com- 
ponents were unknown, it would seem that the only practical solutions must be predicated on either 
a huge sample of cipher text (correctly assuming—without foundation—the length of the introductory 
key) for the possible application of Fourier techniques and other palpable mathematical approaches, 
or a sizeable quantity of matched plain and cipher text—if we are to call these practical solutions. In 
the next case to be examined, let us assume a knowledge of the general system, and let us further assume 
that the plain and cipher are unknown mixed sequences but that the sequence for the keying (i.e., for 
performing the modular arithmetic) is the normal sequence. Therefore if we had available some matched 
plain and cipher, we would also be privy to the keys involved. Let us now study the two message be- 
ginnings given below: 


5 10 15 20 25 
21 20 14 10 
K: UTNJZBUTZFGJZRPYLMIFBRIJUXE 
1 P: REFERENCEYOURMESSAGENUMBER 
C: COHEHWGQUGROHEKFSLBANWWVZW 
12.7 17 4 
K: LGQXHANPWMSVKLGBGHNJSVTHA 
2 P: REFERENCEYOURMESSAGENUMBER 
C: TBKSPVZMRNDASYBINGGEEAGFVO 
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- If the keying sequence is the normal] sequence, then in Message No. 1 the sum R,+C,=21=U will 
be the key for enciphering the second plaintext letter; and the sum E,+0,=20=T will be the key for 

‘enciphering the third plaintext letter, and so on. The 50 key-plain-cipher relationships derivable from 
the foregoing diagram are inserted in a reconstruction matrix, as shown in Fig. 184, below. 


Plain 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 














NK MSS CHNWOVOZETAGCHIOQBNAOCAMS 


Fiaure 184 


Noting in the A column that G, and L, are opposite G, and Ly, we capitalize on this implication and chain 
our cipher letters to the § column outside the matrix. The partial chains are the following: 


Cols. 6-B: JV TF 


g—-C: NM UQ 

@-E: HV IA LB NE PRK QS TUO XZW 
@-F: GK TH , 
g-G: HG MB 


@-M: KY RW VG ZE 
$-N: AZ BG FN JE 
$-O0: FR MD 

@-R: AO EW JH VS XP 
g-S: BN GI PF YS 
g-U: BW GO SA 

g-Y: WN ZG 
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From these chains the following equivalent primary cipher component can easily be reconstructed: 
XZWYTUOQSPRKLBFJDGNEMCIAHYV 


This sequence is then decimated at various trial intervals, and when the decimation of —7 is reached, 
it will be discovered that the original cipher component is based upon the diagram below: 


6124573 


MACHINE 
BDFGJKL 
OPQRSTU 
VWXYZ 


The plain component can now be recovered by juxtaposing a blank strip against the known cipher com- 
ponent, designating an arbitrary cell as the index position against which to set the key letter, and filling 
in the plaintext values at the various positionings of the sliding cipher component. This yields the 
following sequence: 


AG.S..B.QU.EF...M.N.YRC. 


Although there are only 13 different plaintext letters in our component, the recovered sequence can be 
put together as in the diagram below, revealing the key word DREAM: 


25314 
- REA 
BCFG 


M 
. .N 
Ss. 
x. 


co- 


e. For the third case, we have the following matched plain and cipher beginnings of three messages: 


5 10 15 20 25 
l REFERENCEYOURMESSAGENUMBER 
OBPXSVPUZLJALFAXXEHXVHEFPL 
2 REFERENCE YOURMESSAGENUMBER 
ATFOBKFCLDEGDMGOOHSOKSHMFD 

3 REFERENCEYOURMESSAGENUMBER 
DEKLJOKBUCFICRILLMQLOQMRKC 


To our utter astonishment, isomorphism has appeared in a system we could have sworn could not pos- 
sibly yield isomorphs, since plaintext autokey is one of the features involved in the encipherment! Never- 
theless, doing what comes naturally, we derive the following sets of partial chains from the foregoing 
beginnings: 

Msgs 1-2: XOAG JEHSBT PFM VK UC ZLD 

Msgs 1-3: VOD ZUBEM PK XLC SJFR AI HQ 

Msgs 2-3: ADCBJ TEFKOLU GI HMR SQ 


These partial chains are quickly put together into the following cipher-component sequence, 
JEHSBT.UVUC.ZLDIXOAGVKR.PFM Q, and upon trial decimation we dis- 
cover that at the interval of —5 we can recover the original key word upon which the sequence is based: 


753496182 
TMARE 
JKLOP 


nar 
Gua 
a9 x 
as = 
NOW 


B 
Q 
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The plain component is found to be identical to the cipher component, as is also the keying sequence. 
The isomorphism is a result of identical cipher and keying sequences, the constitution of the plain com- 


ponent being irrelevant. 


JS(1). For the last case, we shall examine the matched plain and cipher of the following eight message 


beginnings: 

5 

1 REFER 
FAONA 

2 REFER 
HQKHS 

3) REFER 
AGXXV 

4. TOCOM 
RNHSA 

5. TOCOM 
VTGZJ 

6 TOCOM 
MFCLT 

7 RECON 
TKJIE 

8 RECON 
JERJA 


e242 CFA] AR TRS HR re nF aw 
Or FP CrP OF KP zz om as 


HH BH FZ AA NZ Za TA NA 
wn On NO DO FY nw eh ZH 
Qn FN OH OH CH wae Ge RHE 


ar Pr mz Uetz OZ Heo Wyo #0 


8H2z2 2240 TQ WH oa oc <c 
Za FQ 00 HO U0 uw ww WD 
Qn uA Nw? GA On az wz VEZ 
ra HW OF TAN ww ww mS 
Km OF ZH KH MH wn rH KN 
wo KU PDQ KD CQ MH AN an 
wo roan Ss xm wr WP CP 


>D ADM ND OD AWM Wa ZA Gn 


TH SH rn aon -HN ecm rm <BBE 
qn Rn CP OP Pe ws ez we 
OH QH BSrar str oa Hae BG 
uaz rP2 ar Dal Ker ae wz ws 


HO NY AC AGC Za pnw aw aw 


BH OH O22 WA Laz op yw oOomsS 
ra <Q GH OF HH TW ww OF 


ne Cr Za 2H oH 


zoe DM NM HN 


Hm QP 


We begin by indexing the vertical plain-cipher digraphs and, in the hope that commutative keying 
(i.e., involving only one keying sequence) is present, we index the first four vertical digraphs of Msg 
No. 1 as FR, AE, FO, and EN. From this index we list the key digraphs occuring two or more times to- 
gether with the plain-cipher equivalencies which directly follow them: 


OMDNOAQANANEH 


Key 
AA 


AL 
AM 
AN 
AQ 
AR 
AS 
AU 
BG 
BN 
CH 
cL 
CN 
CR 
DI 
DN 
EE 
EG 
EH 
EI 
EK 
EN 
EO 


PoC equivalents 


—C 
LV 
LW 
EE 
DS 
NC 
EG 
AA 
GU 
EU 
UF 
EV 
uT 
CZ 
SA 
ND 
GH 
SH 
FX 
RS 
SQ 
SK 
RA 
RH 


N 
TY 
MI 
NY 
II 
TH 
TN 
NA 
OJ 
IQ 
0s 
AS 
DB 
TW 
IE 
DI 
CR 
NC 
NW 
CL 
RC 
GJ 
FJ 


EG 
OJ 


RL 


CJ 
NL 
PK 


ivalent 
IN 


42] 


24. 
25. 
26. 
27. 
28. 
29. 
30. 
31. 
32. 
33, 
34. 
35. 
36. 
37. 
38. 
39. 
40. 
41. 
42. 
43. 


45. 


Key P-C equivalents 


EQ 


RD 
NO 
NB 
EN 
FO 
EH 
EV 
TO 
AY 


FQ 


ivalent 
FK 


XT 
YJ 
IM 
ID 
IJ 
NB 
SB 
CA 
cv 
NA 
EE 
IG 
EY 
MT 
GB 
SS 
sI 
MF 
ON 
MT 
EC 


RY 


cc 


AU SH OF 


EI 
CG 


EK 





The foregoing plain-cipher equivalents are now indexed in order to equate key equivalents. It is dis- 
covered that the plain-cipher equivalents AU, EE, EG, EV, MT, NA, NB, NC, OJ, and SH have occurred 
twice each, so we are able to arrive at the diagram of equivalencies shown in Fig. 185, below: 








Keys P-C_ equivalencies Keys P=-C equivalencies 
1. BG CR|TW OJ EU SA 19. EN/RA GJ NL 
2. CL/AS UT 20. EO|}RH FJ PK 
3. EE SU MT/AU BY MT SH OF CR 21. EQ;RD FK 
4. JR AM/EE MI SJ 22. ES|NO YT RY 
5. CN AR|EG TH CZ DB 25. FO|EN IM CC 
6. EV GU CH\|EV OS NB YJ 24. FS|FO ID 
7. JO AU/NA GU FQ 25. GN/EH IJ 
8. EG AQ|NC II FX RL 26. II|/TO SB 
9. AA|LV NN 27. jIM|AY CA 
10. AL|LW TY 28. IO|NE CV 
11. AN|DS NY 29. KS|SU IG 
12. AS|AA TN 30. LRjUG EY 
13. BN|/UF IQ 31. NO|CH GB 
14. DI|ND IE 32. NT|CN SS EI 
15. DN|GH DI 33. OT|/UQ SI CG 
16. EH|RS NW 34. QU/RT MF 
17. EI|SQ CL 35. RT|MA ON EK 
18. EK|SK RC CJ 36. TY|OV EC 
Figure 185 
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. The values of the plain-cipher equivalencies are inserted into a reconstruction matrix, as shown in Fig. 


186, below: 


COMDNDA OARUANE 





ABCDEFGHIJKLMNOPQRSTUVWXYZ 





























U J AW 
5 T 
UVR T F H 
E I J 
ZBG H 
V BS J 
Qu A 
xX I c L 
VoeoON 
W Y: 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
Ss Y 
A N 
Q F 
E D 
I H 
W s 
L Q 
J cK 
J L A 
J K H 
ABCDEFGHIJKLMNOPQRSTUVWXKYZ 
K D 
0 Y T 
Y 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
H 
N 
G 




















ABCDEFGHIJKLMNOPQRSTUVWXYZ 


Ficure 186 


423 





foe 


The following chains are derived from the foregoing matrix: 


i- 3: 
l- 4: 
1l- 5: 
l- 6: 
1-26: 
1-32: 
1-35: 
1-36: 
3— 4: 
3-17: 
3-18: 
3-27: 
3-32: 
3-33: 
3-35: 


JF 


4-32: 
4-35: 
5-23: 
5-32: 
6-22: 
6-35: 
6-36: 
T- 8: 
T—19: 
8-14: 
8-16: 
8-19: 
8-20: 
8-21: 
8-22: 


co 


LY 


8-24: 
16-19: 
16-22: 
17-18: 
17-32: 
17-33: 
18-32: 
18-33: 
19-22: 
20-21: 
25-25: 
25-32: 
52-33: 
35-36: 


These chains may now be combined into the following cipher-component sequence: 
SVCLAXFQPEOYGRTBIHZJUDNKMW 


When decimated at an interval of —9, it can be analyzed and found that this sequence is derived from 
the following diagram: 


6124573 
MACHINE 
B D) 

FG J) 
KLOPQRS) 
TU V W) 
XYZ ) 


(2) We now place our recovered cipher component in juxtaposition against a blank plain-component 
strip and, referring to line 1 of Fig. 186, we write an E, over the U, and O, over the J,, an S, over the A,, 
and a T, over the W,. We then slide F, under the 0O,, and, referring to line 3, we write A, over the U,, 
B, over the V,, C, over the R,, and so forth for all entries of line 3. Continuing in this vein, we recover 
the entire plain component and find that it is based upon the following diagram: 


Qwa 
“A 


14 
AM 
G) 


<Hzau 
= ox 
“x uv 
~ 2 


Ne CMNCMHDwWODW 
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(3) The final step is to recover the mixed sequence used for the modular sums of the key. Referring 
to Fig. 185, since we now know the plain and cipher components, we can arrive at artificial key values as 
measured on the pair of enciphering components. For example, in line 1 of Fig. 185, the equivalence of 
E,=E, is designated as the key of N (using A, as an arbitrary index letter), and in line 2 the equivalence 
E,=G, as in the key of W, and so on. In this fashion we can determine the following equivalent modular 
sums as measured on the unknown keying sequence: 


1. JR = AM 
2. CN = AR 
3. EI = RT = OS = AN 
4. EG = AQ 
5. QS = CR = BG 
6. MT = EE = DI 
7. AL = OT 
8. AS = GN 
9. CL = EK = DN 
10 EH = LR = NO 
ll EO = TY 
12 ES = FO 
13. JM = LN 
14 JO = NT 
Figure 187 


This means that the mod-26 sum of J plus R is the same as the mod-26 sum of A plus M, and so on, within 
each of the 14 lines of equivalencies. Two approaches are now possible: either a mathematical] one involv- 
ing a rather messy set of simultaneous equations with barely enough material for a solution, or a crypto- 
logic one involving the standard techniques of indirect symmetry of position. 

(4) We insert the relationships of the 14 rows of Fig. 187 into a matrix, as shown below in capital 
letters. 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 


: 


ONADTANNE 
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The top row (the § row) in conjunction with one of the other rows shows that the expressed equivalencies 
have identical modular sums: that is, in rows 0-1, the combinations AM and JR sum to the same number, 
mod 26. Since we have already proved that there is commutative keying in the cryptosystem, the MA 
and RJ must also sum to the same number with AM and JR; therefore we may insert these reciprocal 
values into the matrix, as shown by the lower-case letters. Chains are then derived from this matrix, 
as shown below: 


l- 2: MR JA 3- 8: NS OAG 7-11: TE OY 
1- 3: MN JT 3- 9: IK AD 7-14: TJ ON 
1-135: RM AJ 3-10: IH AO SN TL 9-10: KH CR DO 
2- 3: RN CAT 3-11: I0 SE RY 9-13: CN DL 
2- 5: NR AC 3-12: ISF OE 10-11: HO NE 
2- 8: RS CG 3-14: AT SJ RN 10-12: HS NF 
z- 9: NL CD 4-5: EB AS 10-13: RN OL 
2-10: CO AL 4-8: QS EN 10-14: OT NJ 
3- 4: NQ IG 5S- 8: BN QA 11-12: OS EF 
3- 5: TC 0Q 6- 9: IN EK 11-14: EJ YN 
3- 6: IED RM 6-11: EO MY 13-14: MO LT 


3-7: NL ST RO 7-10: AR TN 
These partial chains can now be amalgamated into a single chain with six blanks, as follows: 
AJY.O.QRMIEDTHCSL..NKFG..B 


This sequence is either the original keying sequence or, more likely, a decimation thereof. Referring now 
to the matched plain and cipher of Message No. 1, 


REFERENCEYOURMESSAGE 
FAONAGCZMKWVBDKKUUUV 


and by using our recovered plain and cipher components, we can determine that if E,=A, at position 2, 
the key letter must be H, (under the assumption of A, as the index letter). If the commutative keying is 
expressed as a strip sliding against itself, the mod-26 sum of R+F=H at position 1 can be represented 
on the keying strips as follows: 


(1) AJY.,. 


0.QRMIEDTHCSL..NK(#G..B 
(2) .NKFG..BAJY.0.Q@QMIEDT 


CSL. 


which means that the first element (R) of the equation R+F=H is under S as an index. At position 3, 
F,=0, with our sliding strips means a key of Fx, so the alignment of the keying strips for the mod-26 
sum of E+A=F must be 


ibe eae eae ee ae 
2) WMG..BAJY.0.QRMI@®DTHCSL..NK 
and again the index letter in the upper strip is seen to be S. By using the data in the message beginnings, 


we can recover the entire keying strip as follows: 
AJYZOUQRMIEDTHCSLVWNKFGXPB 


Even though this is a decimation of the original keying sequence, it nevertheless will suffice for the 
cryptographic operations of the system, which has now been laid completely bare. 

g. These solutions teach us a lesson we are sometimes prone to forget. The original cryptoprinciple 
of the machine appeared at the outset to be extremely complicated in analysis, and as we learned more 
about it, at each step we were temporarily beset by insurmountable obstacles that we speedily managed 
to surmount. In the end, all the approaches to solution appeared quite straightforward and obvious. 
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83. Analysis and solution of a second case.—a. For the second example of an apparently complex 
case of aperiodic encipherment which yielded to facile attack we shall quote verbatim an article by 
‘William Lutwiniak which appeared in the NSA Technical Journal, Vol. I, No. 3, October 1956: 


SOLUTION OF A POLYALPHABETIC MONOME DINOME SYSTEM 


By William Lutwiniak 


An interesting use of monome-dinome matrix encipherment has been suggested by Mr. L. D. Callimahos. His scheme 
calls for 10 matrices, used successively, to encipher the plain text. The ten matrices are generated from one basic matrix 
by systematically displacing the coordinate sequence one position at a time. By way of example, if the basic matrix is the 
first one shown below, 














4517062839 §170628394 1706283945 
-[SE-RATIO-N| -(SE-RATIO-N| -(SE~RATIO-N 
l1BCDFGHJKLM! 7IBCDFGHJKLM) O|JBCDFGHJKLM 
SiIPQUVWXYZ - S9IPQUVWXYZ 3 4iPQUVWXYZ ; 

Matrix 1 Matrix 2 Matrix 3 
then the 2d, 3d. . . 10th are generated as indicated. Plain text THE if started in the first matrix, would be enciphered as 
6727. Note that the row coordinates are slides of the column coordinates. The first row is successively 1, 7, 0,. . .5 and 
the second 3, 9, 4,. . . 8. The distance between the pair of row coordinates for a given matrix, measured on the sequence 


of the column coordinates, is fixed by the position of the blanks on the monomic row; this distance is the same for all ten 
matrices. . 

The system gives rise to some interesting properties. The original plain language has a rigid cycle of 10, but the 
average cipher cycle equals 10 plus the relative frequency of the letters enciphered by dinomes. In general, these fre- 
quencies vary between 33% and 60%, depending on the number and relative frequencies of the monomes composing the 
top row. In the example given above, the eight monomes are the eight most frequent letters in English, which normally 
make up 66% of plain text. The cycle of the cipher would thus average 13.3%; this, however, is a purely statistical cycle, 
and the cipher text would give the appearance of being aperiodic. 

One other feature is that the cipher text is guaranteed to be monomically flat. Each digit is used in turn for all col- 
umns and rows; hence whatever inherent bias exists monomically in the basic matrix will be systematically and equally 
distributed over all 10 digits. 

Mr. Callimahos submitted for consideration a 925-digit message as a test problem. All that was known was that the 
encipherment proceeded as indicated above, by systematically displacing the horizontal coordinate one position; the loca- 
tions of the blanks on the monome row determine the successive row coordinates. The number of the row coordinates is 
unknown, as is the underlying language. The first 210 digits of the message are given below: 


10449 07975 17385 22105 66917 59439 
34609 25068 45390 41708 10853 88244 
77075 56813 64907 53219 81512 10747 
67995 85559 42239 97960 99588 98815 
67081 46001 36068 46858 23918 46256 
29022 71354 90862 93823 07778 03218 
171501 63758 4011618292 70352 29250. 


A STETHOSCOPE run on the material elicited the following facts: 
Monomic delta I.C.: 0.999 (As anticipated, flat) 


Dinomic delta I.C.: 1.07 (4.6 sigmas) 
Trinomic delta I.C.: 1.29 (6 sigmas) 
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The repeat rates at distances 1 to 10 were not significant. The following polynomic repeats, all occurring twice, were listed: 


Size Number of pairs 
5 
6 
7 
8 
10 
11 


ee Pp OO 


The distances between these repeats, as expected, gave every indication of being aperiodic; the shorter intervals involved 
were 24, 51 (twice), 63, 69, 75, and 82. It had been hoped that the statistical cycle could be inferred from the shorter 
intervals between repeats, but the observed data are insufficient. A count of repeats at distances from 1 to 20 should peak 
at the statistical cycle; however, an attack was devised that did not require this information. 

Referring to the sample matrices at the beginning of this article, the following are the 10 successive encipherments 
of GETTYSBURG: 


Plain 

G ETT Y § B URG 

1 101831463269557 
2767397529824110 
3 0209401843 85776 
4686456735931002 
5 232512091497668 
6 898178647540223 
7 343703250156889 
8 9590698167123 34 
9 414624372078995 
10 575285908603 441 
Pattern: ABACDAEFDGFHIIJ 


It will be noted that all versions are isomorphic to each other, since all have the pattern ABACDAEFDGFHITJ. Further, 
each of the 15 columns is a slide of the actual horizontal coordinates. At first glance, it seems a little strange that the row 
coordinates behave no differently from the column coordinates: all are slides of the basic sequence. However, it is readily 
apparent that the designations for each row are determined by the fixed location of the blanks in the monomic portion 
of the matrix, and hence must be slides of the basic sequence. What is not known is the distance (as measured on the 
basic sequence) between the blanks, and there is no information derivable from the isomorphs that bears on this question. 

Consideration of the encipherment scheme makes the reason for isomorphism quite clear: the location of the plain 
values in the matrix is invariant; only the coordinate values designating the plain vary, and these values progress regularly 
one position at a time. Each individual plaintext repeat must be associated with the isomorph caused by invariant plain 
positions in the matrix, regardless of where the repeat starts in the sequence of 10 matrices. A ciphertext repeat is merely 
a special case of isomorphism; i.e., a plaintext repeat which starts at the same point in the 10-matrix sequence. 

This suggests a simple, straightforward attack based on this phenomenon: locate long isomorphs; then reconstruct 
the basic coordinate sequence by the principles of indirect symmetry. It is true that this reconstructed coordinate sequence 
may be a decimation of the true one; but there is a procedure for selecting the correct one from among the possibilities. 

In order to avoid a tedious isomorphic search, the longer hits located by STETHOSCOPE were listed and patterned as 
follows: 


Repeat Pattern 


ono 
ow 
an 
“_ 
ons 
HU 
aa 
Q 


O°nwys hID Ww OW 
Oi ~W]0O DO rk & 
NiDwWIO aa Ay 
NIC VIA OD O 
PL> PS l> > > > 
Dols Wis ww 
ajaajaaaa 
Qqwawnwo0og 
Ol> Ol> mo 
Bie Ql | aw 
Ole Film 2 a m4 


oO 
a 
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' Fortunately, there is an isomorphic repeat with patterns ABCDAEE among these repeats. This pattern was searched for 
elsewhere in the message; since it already indicated a plaintext group occurring four times, it was expected that there 
‘ might be other occurrences. The following possibilities, including the original pair, were found: 


ABCDAEE 
(1) 6804655 
(2) 2785233 
(3) 3092344 
(4) 9358977 
(5) 1540188 
(6) 7523799 
(7) 7084722 


If the members of the original pair (1) and (2) are taken as correct, (7) cannot be right, since there is a repeated digit (8) 
in column C of the pattern. The mechanics of the system demands that between a pair of isomorphs, the corresponding 
digits must either all be different or all be identical. The other conflict remaining, after eliminating (7), is that both (5) 
and (6) cannot be correct: there is a clash in column B. This clears up quickly when it is noted that (4) is contained in 
the 11-digit repeat, and that (6) involves the beginning of this repeat—23799. The fact that one of the 7-digit isomorphs 
was contained in the 11-digit repeat led to testing the 4 digits preceding the remaining 7-digit isomorphs, and the follow- 
ing was built up: 


ABCDDBEFDCC 
(1) 18566804655 
(2) 97322785233 
(3) 70433092344 
(4) 23799358977 
(5) 1540188 


The principles of indirect symmetry were applied, and the following equivalent sequence reconstructed: 9306827415. 
This is either the true basic sequence or a decimation of the true sequence at intervals 3, 7, or 9. (Had the true sequence 
been such that even decimations, or a decimation of 5, produced either 2 sets of 5 or 5 sets of 2, all relationships obtained 
from the isomorphs would have had these properties and hence an unbroken sequence, as reconstructed automatically, 
eliminates the even decimations and the one at distance 5.) 

Before attempting to select the correct decimation from the four possibilities, let us consider the properties of a 
monome-dinome matrix. The numbered rows, in the least favorable case (where 8 monomes represent ETNROAIS), must 
contain 33% of the plain text. This percentage increases with fewer and/or less frequent monomes. Thus, there is often a 
tendency for dinomes to follow one another sufficiently often to be distinguished from the random case. In the system 
under consideration, an “‘A—A’”’ dinome count (in the sequence ABCDE. . ., A-A dinomes are AC, BD, CE, etc.) will cover a 
situation where a dinome from a particular row is followed by another dinome from that same row. However, in this 
respect, we cannot distinguish one row from another: each time a dinome from any given row is followed by a dinome from 
that same row it will be reflected in the A-A dinome count, since each row is a slide of the basic sequence starting at a 
different point. We do lose the information when a dinome from a given row is followed by a dinome from some other row. 

The following is the A—A dinome distribution: 





Pa 

0123 45 6 7 8 9 
0} 413 9 91011 9 9 810 
1,810 9 8 41115 510 6 
2:16 5 613 7 3 6111115 
3/1012 6 411 5 4 910 5 

6' 4114 510 6 411 71113 7 ° 

5}10 2 9 812 9 51013 13 
6| 612 7 16 8 8 4 914 
7| 7 7 811 61312 91210 
8}11 10 13 1013101011 811 
9} 5 614 81214 41713 9) 
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The four decimations of the reconstructed sequence are tried in turn by noting the frequency of each of the 10 chained 
dinomes composing them, and summing the set of 10 frequencies for each decimation. Thus: 


Sum 
Decimation of +1: 9 3 0 6 8 297 41 5 
Frequencies: 8 © 9 9 Bn 6 5 WB =95 
Decimation of +3: 9 6 7 5 0 2413 8 4 
Frequencies: 4 4 28 0 9 5 8 0 B 7 =83 
Decimation of +7: 9 4 8 3 12 05 7 6 
Frequencies: 2 1 «#30 2 9 1 1 10 1 6M =)19 
Decimation o0f +9: 9 5 1497 28 60 83 
Frequencies: Mu 2 4 9 8 nN 0 6 8 5 =78 


The decimation of +7 yields the highest value and is in all probability the basic sequence; i.e., in the true matrix, a dinome 
beginning with 9 is followed frequently by one beginning with 4, which in turn is followed by one beginning with 8, ete. 
The only information now needed to convert the entire text to monoalphabetic terms (i.e., in terms of one matrix) is the 
number and identity of the row coordinates. One source of data bearing on the identity of the monomes (and hence, on 
the row coordinates) stems from the situation where a monome intervenes between two dinomes. Representing this situ- 
ation as AB C DE, it is apparent that what is required is a selection of dinomes AD such that the digits involved will come 
from matrices once removed from each other. The basic coordinate sequence involved, 9483120576, indicates that the 
following A-—A dinomes should be extracted from the text: 


w 
Q 
we 


HAKONHAOA OP 
BRODATONKF ADS 


Then the frequency of digits appearing in position C would be tallied; these 10 distributions can be combined by equating 
them according to the basic sequence; i.e., arranging the counts in a 10X10 matrix and summing the left-to-right down- 
ward diagonals, The lowest diagonal sums should be the row coordinates sought. 

Herewith are the distributions of the C digits for each of the 10 specified dinomes from the sequence 9483120576. 


Dinome: 98 43 81 32 10 25 07 56 79 64 








9/2 1131%1-2 - 3 1 
4/1 11-12-31 -+ 1 
8/1 - 31-3 -1 2 = 
3/1 - 2131-2 -+i1i41 
lie - 114212122 - 
2/3 2 -12-+i1-2 - 
oj;l - 1-412 i1-+ - 3 
§/5 1131313 44- - 
Ti- - 111-+4di12 ‘- 
6/- - 112--- 1 3 
Diagonal Sums: 7219 712 9 412 16 21 


This would indicate that there are two rows, and that the blanks are spaced 5 apart on the basic sequence. Thus the 10 
successive pairs of row coordinates are 92,40,85,37,16,29,04,58,73, and 61. It only remains to determine where in 
this sequence the message starts. The easiest way to test the 10 starting points in turn is to complete the plain component 
sequence, extract the putative monome-dinome stream for each assumption, and evaluate it by the proportion of monomes 
to dinomes. In the correct case this will approach 1.9 or less. 
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Herewith are the first 60 digits of the message, with the plain component sequence completed down the columns: 


ANNONHAOAL 
NQNOonruaorsA 
NOonruawma wo 


ADMDhODANAON 
NVEPADARODNAGA 


o 


YNIONKEUAOR 
ONFUDLWOD 
VE@OnoOn IIE 


WhRODIWMIONE 
© 
~ 


on 
ne 


ao-r 
Aw 
0 
@) 


ONKFUADhRODN 


0 


ONF 
© 


oOoanvran 


@) 


OnOD A 
® 


AOR OD ~ 


NrAO hh Oo 
OONnNeY AWW 


AOA OD I 


BS 


@oarnonruaoc 
aon 
Yuo ora 
& OO NQonr 
ADM ONHEWO 
sles 
CONF UOKO aD 
OnOHAMON 
hONA’TISONH 
ADhODAKDN 
ADRODAWWION 


9 


OrANOW 


Cael. 
@®oora 


ara 

PAO 

ON AO 

YHA oO 

WAONHRY 

hOnWWON 

ONAT SNE 
ROD ATONE) 
YAONEFABOAO 
HAOROnDITO 

WAHONHEWOL 


5 


AoOhOD 
OO PO 

1 © pb oO 

aonre 

oar 

Ia 

Glee 

‘CES 

foe 


9 


ohoonru 


t 
e 


OhOOAMNO 


© 


UM)AODINE 
ae 

WANN 

Joon 

Ooraon 
ADAOM 
aonra®d 
ONFWNOAH O 
OOANTONFN 
Oh OONAMONE 


Nr 


Jao 
OO 
“Joo 


oY 
n 


Ha 
RODWONHEWO 
RODATONHAG HATonewA 


e 
© 


aonr 


9 


ONFWNAD 


@ 


RODNAATO 


@) 


FPAOMDAhOD A 


©) 


alain oOnrIanonr 

w O(s) 

Ne A 

hOM? 

ANA OD 

Nr WO hh O 

AODAMO 

ONHWOAYO 

OhROD AAO 
ANDAOAITION 
HAKONE ADA 

OMATONEAOA 


In testing the ten possible starting points on the completed plain component, the rule is to read on the same genera- 
trix one position for a monome, or two for a dinome, and then ascend one generatrix for the matrix. The reverse would be 
true had the basic sequence been recovered as a right-to-left progression. In the actual case at hand, it is necessary to test 
for only five assumptions. The positions of the blanks (five apart) gives 5 sets of 2; thus (2, 9) is identical with (9, 2) 


insofar as reading the generatrice 


s is concerned. 


The five streams (derived from the foregoing diagram) representing the ten possibilities for the first 60 digits of the 
message follow; all start with the initial digit of cipher text. The fraction following each stream is the monome-to-dinome 
ratio of the stream. The introductory dinomes are the two row coordinates associated with the particular matrix under 


consideration. 
92 129 6 5 8 3 1 4 6 2 
and 5 6 695 6 03 6 8 0 
2,9 12424 6 790 2- 
4.0 1 2 6708 3 14909 1 
and 9947 95 193 5 7 
0,4 08 08 9 6 45 O- 
8,5 12 6 7 0 481 4 6 2 
and 59 9 45952 4 1 7 659 
5,8 53 4 9 87 5- 
3,7 12 675 832 8 9 0 6 
and 4 87470 8 2 6 9 74 38 
7,3 8 436 7 
1,6 10 967 310 3 4 5 913 
and 36865 3 0 9 46813 7- 
6,1 819 & 


3 423 898 8 3 8B B 26 
52796 1 62427 4 7 3 
801 343 3 13 309 7 
06 49 2 90806 8 6 1 2 
784 288 9 4 488 80 6 
84 0 45359 3 9 2 0 53 
38.033 4 8 833 35 9 74 
5 87174 1 4 0 571 71 
511 8 3 31117 468 8 
36268 2 8 5 7 6262 3 


14 


The (1, 6) possibility looks the best from the standpoint of monome-to-dinome ratio, and, in fact, is correct. In the actual 
solution, 250 digits were examined on the basis of the five possibilities, and the (1, 6) possibility was outstandingly the 
correct one. The following matrix was recovered quickly: 





SECRET 


The key word is obviously REACTION, and the following is the basic format: 





The sequence of column coordinates is found to be the numerical key derived from the internal key word expanded 
to ten letters, i.e., REACTIONRE; the message plain text begins with the words "MOVEMENT OF THREE HUNDRED... ." 

Thus, what at first glance appears to be a rather complicated system yields to a straightforward attack which derives 
largely from simple cryptanalytic fundamentals. The attack depends in the main on the principles of indirect symmetry 
of related alphabets, and the fact that in this instance these principles were applied to digits rather than letters merely 
underscores the fundamental importance of the principles. This is just one more illustration of the desirability of every 
cryptanalyst’s having a complete grasp of cryptanalytic fundamentals: one never knows where they may be applied next. 

The basic system itself was assumed to be known, but the attack would probably have proceeded as above, albeit 
less directly, had nothing been known about the cryptosystem. Thus, aperiodic, causal ciphertext repeats would have been 
observed. Sooner or later isomorphism would be noticed among these repeats and the principles of indirect symmetry 
applied to yield the basic sequence. Once the fact was ascertained that 10 digital related alphabets were involved, an at- 
tempt would be made to determine what caused the aperiodicity. Eventually these investigations would lead to the fact 
that the 10 alphabets were used in order, and a statistical period determined. Among the hypotheses which might account 
for such a statistical period would be monome-dinome substitution. 

Under a long additive for a superencipherment, the system would afford considerable security. It could, however, be 
solved, if sufficient depth were available to permit entry via the classic repeated differences attack, at which point the 
stripped text would be treated as above. The selection could be controlled by a key word, expressed as digits through the 
basic matrix, each digit selecting a matrix in turn. This would render part of the attack outlined above ineffective, but the 
entry via isomorphs would still obtain. Also, selection other than cyclical would no longer ensure monome flatness, and 
the roughness thus exhibited might suggest specific attacks. Isologs would be extremely vulnerable; indeed, most of the 
variations on related alphabet systems and the appropriate attacks relating to them are applicable to the basic system set 
forth here, with the modifications necessitated by the peculiarities of monome-dinome encipherment. A nasty version of 
this system would embrace a matrix with coordinate sequences selected from the ten rows of a Latin square, superen- 
ciphered by a long additive—we reserve judgment on this one. 


b. The final paragraph in the article above mentions some of the “‘if’s, and’s, and but’s,” variations 
possible in the system. In any cryptosystem if the cryptography is too complicated, cipher clerks’ errors 
are bound to arise, and it is often through these messages and their subsequent correction that entries 
may be made, particularly in a difficult system. 

84. Final remarks.—a. Unlike the preceding two texts, because of space considerations this volume 
does not contain a glossary as one of its appendices. It is assumed that the reader has already acquired a 
basic technical vocabulary from a study of the first two texts; furthermore, new terms in this volume have 
been defined on their first occurrence and therefore should be absorbed during the course of systematic 
study. The reader may wish to resort to the NSA Basic Cryptologic Glossary (June 1971) to refresh his 
memory. 

b. Four of the appendices have been included in order to enhance the usefulness of this volume as an 
operational reference manual. Appendix 3, ‘“Tables of the Poisson distribution,” and Appendix 4, ‘“Table 
of the Binomial distribution for p = 1/10,” are of service in evaluating probabilities; Appendix 5, “‘Plain- 
text and random material for sampling purposes,” will be found useful in certain experimenting and test- 
ing situations; and Appendix 6, “Basic letter frequency data, 24 foreign languages,”’ shows the crypto- 
linguistic similarities and differences among monographic and digraphic frequencies of some major 
languages. 

c. As was the case with the previous texts, mere reading of the methods of solution of the various 
types of cryptosystems covered in this volume is not enough to ensure complete understanding of the 
principles and techniques presented. It is therefore strongly recommended that the reader solve the 
problems contained in Appendix 7, ‘“‘Problems—Military Cryptanalytics, Part III,’”’ as a means of ac- 
quiring facility and adroitness it the solution of aperiodic ciphers. 
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d. The formal portion of this text will be closed with a synoptic chart of cryptography found on the 
next page, continuing the series of char'ts established in the first volume, showing the relationships among 
. the various cryptosystems treated in Military Cryptanalytics, Part III. This chart is a continuation of 


the chart on p. 318 of Military Cryptanalyties Part IT, if we consider the present chart as an amplification 
of the box labelled ‘“‘Aperiodic” in the previous chart. 
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APPENDIX 1 


DE PROFUNDIS; OR THE ABC OF DEPTH READING 


This article, reprinted here with minor emendations, first appeared in the NSA Technical Journal, 
Vol. 2, No. 1. It is included here not only because it is a self-contained, concise explanation of the prin- 
ciples of depth reading in alphabetical, digital, and Baudot systems, but also because it is a particularly 
instructive example and model of how to write a lucid technical paper calculated to reach a majority of 
readers, especially including those who may not be versed in a subject under discussion. 








DE PROFUNDIS; OR 


-18 USC 798 


-50 USC 3024 (i) 
THE ABC OF DEPTH READING 86-36 





By Lambros D. Callimahos 
(A concise explanation of the principles of depth reading in alphabetical, digital, and Baudot systems.) 


The Editor {of the Technical Journal] informs us that he is perpetually trying to cajole our engineers 
to write the ABC of this or that, in a fashion calculated to explain to the nonengineer the mysteries of 
black boxes; that is, produce articles intended to be basic introductions to something or other, explaining 


the obvious for the benefit of those of us to whom it is not obvious. Much to the Editor’s surprise, one of 
these engineers buttonholed him, saying: ‘“How about an article explaining what 


Most engineers don’t know.” The Editor approached the writer; the writer, tit eee 
the title from the engineers; what follows is, we hope, an answer to this request. : 

It is assumed that the reader has some idea of the concepts of letter frequencies of plain text.. We ° 
know that, for instance, the letters of English text have greatly varying frequencies, ranging from an E 


of 13% and a T of 9% to the group of letters JKQXZ whose combined individual frequencies sum to 1.4 


per cent.? If English plain text is subjected to a simple monoalphabetic substitution, the ratios between 
the frequencies are not changed—only the identities of the letters; 


. Sa segee 
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RM OMOMN AMM EMEP AR DKO 
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SIP ZDIMNHOHSENAPYxMONnNT 
SIONS AOMP DH KNODAZE 
ZIP FHS OMNOE XM MOUNUAmE 
SIQSHAATMSEXMOUMDNENE OH 
SP PM HON KHNMAPAEO 
mIpatHeSHNxXP AHA ZODTD EAH 
SOMOS BHAMON}FEND MH E 
PIANMOOHPENARDTUADEA 
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AAAMNNNNN KN 
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Synoptic Table for K 
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23 HF LJINSBOJIYYHDHD 


<< & 
xz > 
N << 
Wax 
tea 
Ok& © 
mY 
~ rym 
HA 
LO 
Hp 
=a. 
Oo = 
aN 
ou 
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Synoptic Table for M 
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BAAWunoWnx PMH ANA ZMD 
Sree OOPRrIUIONnrRROTL 
ZFANHAHTASWVOBDOMN ae 
ZMxeADO0OHRmMetenkhad 
MBIOAOUANRE RHA tre ze 
SQAOHRONMN MDE AN XK Om» 
FHMOMQNWMDAANORKEO 
ZSOBAAAOMONDAIUPrP TAS 
S2mORR CHMOD MNDKOMO 
SBEnNnNerdinxonrtTraAawonrsk 
2c ort yMenorwazae 
EmRCGOOQFAMDPHOAIN 
Z2MOMNMONTRNEOHP OMA 
SBSRATAVODOVNEMPAaN 
ZNmM>S OA AOTDEFAHN 
Sea MOnSrF NOK FHO 
ZOOM FOURARHANNMAOH > 
ZSOHOAXM CAHrANOMNEMDHO 
SORE ATM OWN DAAHMA 
Ske DtOMOOH MH OM ZA 
ZN xMORKRAPOMAOMH 
EMMOCSP AHA HT HKNY 
SrxOI2MUMDAMNONHA ME 
BODrP Hy UNALRLONXMENM 
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CANMTNMOPANOANNY 
Hoda 
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Synoptic Table for N 
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Synoptic Table for 0 





2 3 4 5 6 7 8 9 1011 12 13 14 15 16 17 18 19 20 21 22 23 24 25 


1 


OM MH MH MNO ZMQTDLTHR EHH PrP UMOAWZAN AianNOMxXHMHANAZMD 
ONHAMOTANR MHASH UTAH SPM MOTE DOU aloe BS SPMMOOEFDUUIONH 
OFM TMEAINHPSZSNOMUNAN AMM E MAP AREDE RW. OMNaAxe MX Eee Qe Dp 
OR HF HEP NROANHRAMIMSMHONUEMADOD QaDOOR Ry HES HNRAYAH 
ON MH MOKNDEBEDAVWOINEFHHA EP SM IUKeY nj o> ZM OM UO Mb] OM ks, 
Or MAaHMna TV EFSAUBON MD HAN HK OU SH RIVPHNSMIFBZOOROMN 
ODNm Hex SZORMTPOBHMANHMDAANOTAH SIDANAWHHONDaDYIEM ZY 
ONBDHAU>S OOM HM HPHMOHE RM TANAZOZHWOM 2a OPO MMH ROH EM 
ORR TMHAONN KX AMORFUGHMMSM A Ze AM Sm a TAOFUCHMMNM UA Pans 
OM RAM MON ZOMHPUHESEENMP UNM ONTAA bam tO ZOM HOH SEN 
OF RAOAMAUNSAAMP DHE NODHDZHORm| SH SIA Me>THsKMNUDHAAHO 
COPMNMNFHODAOINOBRKMMONAMUAZA HYMNS Ks © SPM NP HOOITNOR XM 
OMA mA ZOUOQHHALMNAMUMONE NEO > 2 aakhad zo VHIArM Ss 
OMFS SZaATOUODDHMH ANN KR HNMOP>P EE, & AUNM KM HNMAS>HRFOdAS 
SCTPEFAHNYFOUNM MAMAN KAHHENKXPOAZ < HID ZODDBFAHNHOUNME 
OZ BEHMAMONENDM HR BSPHOAMHAYOMARNHOT SRM ONE NOX mn EHOKS 
OH PRENARTONMDZAASMOKMFOMAVDVANNXS OP PS EO Re sr. ae OF 
OCMEMOPENH OH MH ZNDSUAHAXAHTANY > COM FOMEFMOPEAENIOAMA 
OCUNHODPHAORSOHE CIM HN WNMAZHNMADP | 4 whee eoUNnmMADNOKEO 
SOUR KH PMANQHYNLDEONHNNOLkLM SP SwWe tua ChOUH XH DM ZAAN TE 
OAH RP OM MTOR NIFWMSENEF MOM ZODMA VRHeE OMG DONNY EHS 
OOCrARPAZEHAXMNNARDOUOUMNHRUNTIHXM Samed STP AZeEeSeNNDAEOAOMH 
CBN PMOMATNONH AMR OMHRP>P EIN AAM oO TNONH A Mh He OMH > 
OPP HUN ZAOM ME NM MOOD TRHHOMEYS NOx MENNMTOANImH 
OAM NRF SAMOMHORAHNERP Dr SMmMHONMN TIMES MONOMHOOAHDh> D 
SCANMYMOOErDHRDOANNTMNOFPADAMAOANNYNYW FPANMNYHOOPOAMDIOANN 

AANM MMA NAH TATA ANNNNANN Aon nin 


144 YJWFZ2BTYTIEFNGEXRYHWUSEFER 
IS MKLGVJWNVLBFXGOVOAHTJBOCY 
16 HTAJXSASTBELUNWLFSVRMHYHF 
17 TLDHGQHUZDJHZYFXTDCZUKHNW 
18 QMKLAFXMEFAQTRQCHMMXDNMZJ 
19 KOOKFKJGFJILGSSDSECIQQRLFE 
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144 EKGBSLVHPBRRDMKXHUCMGSVRB 
15 ITEILURPMDFDHFSCEIMDOFODIU 
146 GLPFWROJBFBVBAGSUWIGXDTODH 
17 DMHGENGOXJEEMOUHSXKRFELUAY 
18 JOSJMDSBWGJIWKDEDZHBCYTIFYF 
19 FUCHZYYWCHAOGWNEJASKBEOJW 
20 VVZLVZDKROLAXPTOXSEAFBYPJ 
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Bee SOrF TPO BH 
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FUOOHMM HAS 
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Synoptic Table for S 
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O SSSSSSSSSSSSSSSSSSSSSSSSS 





1 


ORM RP MHEANA ZOD THRE EMHAPUMLEOBA RIB MHENA SMD THE EDAPUMOSCBANO HM 
BPRMODTANE MHA KH HAH BEPueOORFDOWNO AIBPHOTANRMHAKHHAMEPMMORDUINON 
HOZrROMUAN «MME MMP OHDROXMTEY RiP DROHMTBANHOZROUGOMNAxM ME MAPA 
BONHAM M ZOMAONUSEMADOO HES aA E> Abe EP NKROANHHMOTMSMHONDEKADOO 
MEPADWOAINEFRPHAA te SMTMVO KM HM kz RRP HARPS ASM EMVOMN HE OENDEDAGTOINE 
ZI FBOUROM MDE AN HOU mHMHOD>P MA RIB MNX OO RFPHOPMANHNA THE EAUROM AD 
HMOMAANOHMEOONXMIRMZURER TMP OBH MA SiR On HORM ZORMPSPOBHMMNEIMDAANO< 
ABOSWAIOMONAHA USP HMM rR RE ROHE METS SJR DHE KEM NABOZWAMONLAYUS DH Mm 
NOX ORMORFUCHMNMH ZS eM Br ORhHTHAD) B CIP TMDMNONDKAMLORUGHMMIYAASS> AM BHO 
LTANMOMLRAmMEORD ZION HUH RB ENMYS IO & RIROH RENE > IKRONTAMNOMEAMAIN ZO M 
OUP MARPONORFRAAMHNMNNSE AAMT MW SIR OKMOFRROAMIONE CAMP THHMNOUDHAZ 
SR MHOARFAMUNPHOAOINOCOE HR MH HDUSZ He © SRK OAMOZH ANE MOORAMO>HDOXTNO 
EOnmPrPOomaAkM et ZODHIAIATMENMUHMDIANE QSRNEOH > OMARM RK ZOVHAOTMBMUKON 
MCAr Foot SSZSHATOVOD VE MHAN MMH Be SRM HANMMHNMAPHMAREOK BS SARAH TIWUODA 
SPF ATAZOLDDEFOHNYOUNMMEMONOAYES So aH|R BENOXM POR RZOTODEFAHNXHOUMMEMAD AY 
rPNOxXS EHOKMAHMARMNUTOZARAKS 5 SRAM ONENSKR HM EHOKM MINOR OLTOZS 
SOOH PANAMA TURD SIA SOK EOWA SC TREN EE ROMS ZARA RRO KI ONMOOH > 
PFORPAXMHDHIA DOME MOPEANIA CHAZ BPP ARKA TAQ OMEKOFENA ONE HAZNS AG 
HAOPMHORSBORE MIMO NM AHMAD MOND TIRE toe DAN MAZHMAPMOUNrXMADHAIOLRED 
Chk M > SOrPHTOMOUNH KR HD MZOAyFNTE OH SIX ZUMOOH KS TIO MZOXANTEMNUHOKM > Se 
SREFHWANSFP MURR AZOOMOAOAH HEH OMTO > CIHR QDMMlCOHNHI BRAN SF MURR ZODM OOH 
THAOMHRODIHAMAMDI OCP AHS E> MN SIR ZEPHHMNYNAMOOCMHRODTHMEBEMDIOWP aA 
ONH SZ HMOMBRP RE IMOAMOBZSHDMUAAT Sl > FAM AMOAB DODO MONRAILINHONHA NM hm Om 
OQAMOODTRH MBH BODSPHUNZAONM KE aH BOD FP HFON ZOOM MENON MOAR IRH DM 
BQEAZAMQOMHUA EP OHTFPSTLHBHONMNOWM IR ONMNOWD MM NAESAMOMHUANERP DZS 
ANMNYFMNOOPFAHDMRDOANMYNOPFTAMOAANQNYNM OCANMTMOKRDHAHOANMYNOOKRADRVANNHY WY 

AAA AAA TH FH ANNNNUNNN AH THAR HAHA TA ANNNNNN 
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Synoptic Table for U 


BIP TRH aEDHPUMOOTEZANOMXKXAEMHANOAZM 
SIPOHNONHMOTANKRMHAKCH OAM EPMO 
ZID BOM ETMANHTSZHOOULYUMNAKMRM EMEP Oe 
RIPOOHmM AES NRAIHHMETMAMVUOND BEM 
RIPACDOINEFHRHA AP SM TAVUVOM NH OHNE 
RIPR MON KOO HFHOSFP MANNA TUF EBEANORONM A 
PDMANOHHEODmH HARM ZURMPOBHAMNDs 
SIPH EM TMANABZOSHWAMONAHU>SH MMH AE 
TPPANDHMHAMORUGCHMM YAP A MBH ORE TA 
SIPM HOH EENMPUIXKMONTANOMRAN AONE 
SI>MAZHOKMORROAMAUNSEAAMS> THHMNY 
SIPAPDMNORSMMOUDUADMHBERMHOQEFAM PH 
RIDPNHENE OH POMARN AE ZODHHNIATMEXUM 
AIP HMHANMKMHNMA>PHMRFOKARAZKATAVWUO 
SIP RF OHNHFOUMMEMANHMHHP RANK POHKZOT 
SID MH RE HOKM DIMARH UOTMOZBEHEAMANEN 
C/> SALEMOHREOMANANMOOHPENAR IO pm 
COD FOAM MAHTAROMEMUPENAION MH AN 
SPQIORBOHE ATK ODMNMAHMASMOUNNMA 
OF MAZOANTENMHNOLM > EHH KUMOOH KL 
LIDPMAOMHHRH OAMEONANARE HEN KORE AD 
*(DOSPrP MH ZREHKNYNAROQUMHRUNDTIM Em 
SF MUAAMNONHA MR HOME> EIAQMORBNH 
AP SHUN ZAOMMENMNMOARMTa&H HME YIRO 
“Dm BS THOMNOIUMKMNARZAMOMHOAnNER> 
SCANMYTYFMNOFADAANMYNOUOPFADOANNTWM 

NAA AN RA AAA AHRNRANNNN 


Synoptic Table for V 


Bi>omovrma 
a[>xMMNorDUY 
Ri> Ak DkhOMm 
Aire nk adH Al 
alae rmmouo 
Ri>nawWnzar 
Si> ot HmmeONn 


> DHX NO 
>HOSINYD 
romrak mat 
~-~HRrOotEa 
rwvrna Zorn 
> ND oS mt EH 
PeENHWEA TO 
~&NAWOD Mm 
i> mMoounrnna 
Ot> ZEHe ato 
wi> es UA hk ZOD 
T(> MWe Ze KN 
o> FI taAmM Os 
A> HUN Zh OM 
a> Dm ELE OM 


8 9 10 11 12 13 14 15 16 17 18 


OUYYCWFNTUETUEJXBH 


CANNY NOR 


BANA 
DRM AZOMOON 
Ory mMkhn & 
BFHOQURLONM 
MOAANO< 
Hex ro tuaA 
TCWoOMNN > 


NORMXEMHANA ZOO Lm EO 
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(Individual and cumulative terms) 
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TABLES OF THE POISSON DISTRIBUTION 


(Individual and cumulative terms) 


I. INTRODUCTION 

1. The importance of the phenomena of repetitions in cryptanalysis is very well known. When the 
cryptanalyst has at hand a sample of encrypted text, it is often necessary or desirable to determine 
whether or not the observed repetitions are causal repetitions (e.g., produced by the action of identical 
keying sequences upon identical portions of plain text), or random repetitions, (i.e., produced purely by 
“accident” or ‘‘chance’’). The number of random repetitions to be expected in a sample of text of a given 
length may be calculated, and this calculation serves as a criterion for the evaluation of the phenomena 
present in the sample. 

2. If each of the n possible elements (where n=10, 26, 100, 676, etc., for single digits, single letters, 
dinomes, digraphs, etc.) has the same chance of occurrence, the probability, P, that an element will 
occur exactly x times (where r=0, 1,2. . . N) in a sample of size N is given by the formula 


P,=C?(1-p)**p* 


where C¥ has its usual meaning (i.e., the number of combinations of N things taken x at a time), and 


p=> The Poisson Tables, so called because they are derived from the Poisson exponential formula 
Ta-8 

a where a= Np, give an approximation to this probability that is sufficiently accurate for values of 

n when 7 is equal to or greater than 26.! 

3. In order to use the Poisson Tables it is necessary to determine a=Np, i.e., the average or mean 
number ? of occurrences of each of the elements in a given sample of size N. Table I (Individual Terms) 
gives for values of a the probabilities for x-fold repetitions (i.e., exactly 0, 1,2... N times). The ex- 
pected number of x-fold repetitions is computed from the Table by multiplying the entries in the Table 
by n. This number, nP, is then compared with the sample under study. Table II (Cumulative Terms) 
gives the probabilities of repetitions of multiplicity ¢ or greater, where c is the sum of all entries in Table I 
for xc. The expected number of repetitions occurring ¢ or more times is here also computed by multi- 
plying the entries in Table II by n. 

4. Samples of random text may exhibit repetitions which vary considerably from the expected 
number. The percentage deviation may be quite large in cases where the number of available elements 
(letters or digits) is small. Only if the deviation is too great, in a given sample under investigation, to 
be due to fluctuations from sample to sample should this circumstance be attributed to causal factors. 
In using Table I, a practical guide that has been found useful for measuring excessive deviation is to 
compare the deviation from the expected with 24 times the square root of the expected number. For 
example, if 72 3-fold repetitions are expected in a certain sample, then the deviation in random samples 
may be +2%/72=+2%(8.5)—+21, and therefore the observed number will usually lie between 51 
and 93. Only if the observed number is outside these limits should the repetitions be considered as 
manifestations causal to the nature of the cryptographic system. 


1 For cases where n is considerably less than 26, the Poisson distribution becomes increasingly inaccurate and there- 
fore the Binomial distribution should be used. Appendix 4, ‘“Table of the Binomial distribution for p=1/10,” for ranges 
of N between 10 and 1200, gives accurate probability statements for digital cases. 

? The average number is usually represented by a small a but, for convenience in printing, the tables have this element 
denoted by a capital A. 
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5. The Table below will assist the analyst in interpreting the deviations from the expected. The 
statistical quantity called “standard deviation’ (represented by ¢) is in this case approximated by the 
square root of the expected number of x-fold repetitions. 


Expected number plus 1 o will be equalled or exceeded once every 6.3 times 
Expected number plus 1%o will be equalled or exceeded once every 15 times 
Expected number plus 2 o will be equalled or exceeded once every 44 times 
Expected number plus 2%e will be equalled or exceeded once every 161 times 
Expected number plus 3 ¢ will be equalled or exceeded once every 740 times 
Expected number plus 3%o will be equalled or exceeded once every 4,310 times 


Expected number plus 4 o will be equalled or exceeded once every 31,500 times 
Expected number plus 4% will be equalled or exceeded once every 294,000 times 
Expected number plus 5 o will be equalled or exceeded once every 3,480,000 times 


IT. EXAMPLES OF USE OF THE TABLES 


1. Two samples of 40 letters each are under study, and the x-fold repetitions of single letters are 
recorded under A and B respectively in the diagram below. The expected numbers of x-fold repetitions 
have been entered in the last column, and were obtained thus: since n=26 and N=40, then a=S=1.54. 
The entries under 1.5 (the value for @ in the Table closest to 1.54) in Table I were then multiplied by 26. 


Sample A Sample B Expected 


NOa rk WNW EK © | * 





The interpretation of the meaning of the decimal fractions in the last column may be given as follows. 
Out of 100 samples of random text of size N=40, 37 of them would have one 5-fold repetition, 9 would 
have one 6-fold repetition, and 2 would have one 7-fold repetition. 

Variation from the expected is usual even for random text. In sample A six letters occur 3 times 
each where only three letters are expected to occur 3 times each. However, there are no occurrences of 
4-fold or 5-fold repetitions, although there is a slight expectancy of their occurrence in these cases; this 
deviation therefore is not sufficient to imply that the repetitions in sample A are other than accidental. 
In sample B the variations from the expected number are considerable. Note the comparatively great 
number of blanks (0-fold repetitions) which would rarely occur in a sample of random text; but of much 
greater significance is the occurrence of 6- and 7-fold repetitions, which have a combined expectancy of 
only .11. From these phenomena it may be safely inferred that sample B is definitely not a random 
assortment of letters. Actually, sample A was enciphered with 25 non-related alphabets, whereas sample 
B is a monoalphabetic substitution cipher. 
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The individual variations of the samples from the expected are “‘smoothed” by a consideration of 
‘the distribution of the number of letters occurring z or more times as is given in the diagram below. 
Samples A and B are the cumulative data of the two samples, while the last column is calculated from 
Table II by multiplying the entries under a=1.5 by 26. 





Sample Sample Expected 

c A B Cumulative Data 
0 26 26 26 

1 21 17 20 

(2 13 9 11.5 

3 6 7 4. 97 

4 2 1.71 

5 2 . 48 

6 2 .12 

7 1 . 02 





2. In another sample of cipher text consisting of 116 digraphs the observed and calculated data for 
individual and cumulative distributions are as follows: 








Table 1 Table II 
x Observed Calculated c Observed Calculated 
606 570 676 676 





Since n=676 and N~116, then a=}#=.17; and the values under .17 in the tables are multiplied by 676 
to derive the calculated expectancies. A few moments’ study of the foregoing data shows that the mani- 
festations in this sample must be due to causal factors, since the respective numbers of 2-fold, 3-fold 
and 4-fold repetitions in the sample far exceed those which could reasonably be attributed to chance. 
The system used in this cryptogram was actually a Playfair cipher. 

3. A cipher message of 209 dinomes has the following distribution of x-fold repetitions. Given also 
is the calculated number of x-fold random repetitions to be expected in cases where all dinomes have an 
equal probability of occurrence. The calculated numbers were obtained by multiplying by 100 the entries 
in Table I and Table II for the value of a=74—approximately 2.1. 





Table I Table II 
Observed Calculated c Observed Calculated 
30 12 0 100 100 
24 26 1 70 88 
12 27 2 46 62 
11 19 3 34 35 
9 10 4 23 16 
2 4 5 14 6 
7 1 6 12 2 
3 0.4 7 5 0.6 
- .1 8 2 .1 
1 . 03 9 2 . 03 
1 . 006 10 1 . 007 
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A comparison of the observed data with the expected data for non-causal repetitions leaves little doubt 
that the repetitions are a causal by-product of the nature of the cryptographic system involved. The 
cryptogram was actually produced by a variant system in which each plaintext letter has four dinome 
cipher equivalents. 


4. The following tabulation gives the distributions of x-fold repetitions found in three samples, 
A, B, and C, of four-letter code text, each containing 275,000 groups. The calculated expectancies 








shown in the second column were derived from Table I, using the value oO 
x Expected Sample A Sample B Sample C 
0 | 250,793 249, 992 249, 481 250, 122 
1 150, 476 151, 348 152, 344 152, 343 
2| 45,148 44, 987 44, 685 44, 312 
3 9, 028 9, 121 8, 825 8, 131 
4 1, 354 1, 342 1, 427 1, 305 
5 163 171 188 395 
6 16.5 13 21 201 
7 1.4 2 3 123 
8 2 26 
9 12 

10 4 
ll 2 











The deviation of the entries in sample A from the expected could be due to chance, and therefore there 
is nothing in the number of repetitions to confirm a hypothesis that the sample is other than a sample 
of random 4-letter groups. It is also quite clear from an inspection of the foregoing data that sample C 
could not have occurred by chance, hence sample C may easily be vulnerable to cryptanalytic attack. 
However, in the case of sample B, although there are small deviations from the expected, it should be 
noted that these deviations, some plus and some minus, reflect the characteristics of deviations usual 
for samples of non-random text (cf. sample C). Furthermore, these deviations are less than our estimated 
norm of 240, except for the first two entries. 





Deviations from the 

x Expected in Sample B 2a 
0 —1,312 1, 252 

1 1, 868 970 

2 —458 531 

3 —203 237 

4 73 92 

5 25 32 

6 4.4 10. 2 
7 1.6 2.9 














However, when examined critically, by other mathematical tests? it may be shown that the set of such 
deviations could have come from a random sample in less than 1 chance in 10,000; therefore sample B 
should undergo further scrutiny to reveal possible weaknesses in other than repetitive phenomena. 
Actually, sample A is an extremely complex form of enciphered code and sample B is code text subjected 
to a fairly complex encipherment; whereas sample C is typical of a simple encipherment superimposed 
upon a code of rather large proportions and condensing power. 


8 The chi-square test. 
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0980214 
0080632 
0929004 


0880001 


Ax2 92 


0135335 
0270671 


270671 
0180447 
0890224 


0936989 
0012030 
0003437 


" 6008859 


2000192 
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A=1.3 
0898001 


A=2e1 


0122456 
0257159 
0278016 
0189912 
0099231 


oP41677 
0914587 
0064376 
0981149 
0098268 


28060056 


e880011 
0002502 


A=2.9 


0055823 
0159567 
0232373 
0223660 
0162154 


0694049 
0845457 
018832 
0006827 
0882200 


00G0638 
0982168 
0800041 
0892009 
©280062 


A23e7 


0824724 
0891477 
0169233 
0298726 
0193066 


0142869 
0688163 
0046568 
0921538 
oO08854 


0083276 
0001182 
0880340 
02808697 
0880826 


eOB8026 
0888001 


A=4e5 


811139 
0849999 
#112479 


A=1e4 


0888882 


A=2.2 


0118883 
0243767 
0268144 
0196639 
#198152 


0947587 
6917448 
0905484 
0001508 
0990369 


0800081 
0990016 
0803993 
0283821 


Axz320 


0249787 
0149361 
0224042 
0224042 
0168931 


2182819 
0258489 
6221604 
0008102 
0002701 


0080819 
0000221 
2O@O0055 
0020013 
#200203 


0000001 


A=328 


0822371 
0885909 
#161517 
0204588 
0194359 


0147713 
0893551 
0950785 
0824123 
0018185 


0803872 
0661337 
0060423 
0200124 
0000034 


#282009 
e28S882 


Ax4.6 


0010052 
0046238 
0106348 


Az1e5 
o282004 


A223 


0109259 
0232595 
0265185 
@2863308 
#116992 


0053775 
0920614 
o206773 
0201947 
0000498 


00G0114 
0960024 
0888005 
0200881 


A=3.1 


6645049 
0139653 
6216461 
0223677 
0173358 


0107477 
0055536 
0024592 
0069529 
#803282 


0991018 
0060287 
e250O74 
0202018 
0882004 


0009GO1 


A2369 


0828242 
0878943 
6153949 
0200122 
#195119 


#152193 
0098925 
0055115 
0826869 
0011643 


0084541 
00016108 
0060523 
0960157 
8009044 


0280011 
oA80883 
e908901 


Az4e7 


0069095 
0042748 
0100457 


TABLE 


Ael.6 


#280906 
0260681 


A=224 


08098718 
0217723 
0261268 
0289814 
0125489 


0260196 
0924978 
0888255 
0892477 
0200660 


2080159 
0290035 
©880907 
e000001 


Axn3.2 


6040762 
8138439 
0288782 
0222616 
0178693 


0113979 
0260789 
0927789 
0011116 
0083952 


0881265 
0900368 
¢988098 
2202024 
©BB0286 


0085001 


Az4.8 


0018316 
08073263 
0146525 
0195367 
0195367 


0156293 
0184196 
0659540 
0829778 
0813231 


0805292 
0001925 
0260642 
0200197 
2200056 


0000015 
#202004 
0820001 


A=408 


080823 
0839583 
08948287 


4 


0 


1 


Azle7 


0008819 
e2BSOG2 


A=205 


0882885 
0205212 
0256516 
e213763 
0133682 


0066801 
0227834 
0089941) 
0023106 
0820863 


0288216 
0200049 
00280190 
2200802 


A=3.3 


0236883 
0121714 
0286829 
0228912 
0182252 


0120286 
0266158 
0031189 
0012865 
0804717 


0001557 
eOO0467 
©$02128 
¢208033 
2200008 


eAOGOD2 


Az4el 


2016573 
0867948 
0139293 
0199368 
0195127 


0162084 
0189336 
0864040 
08328208 
e014951 


6006130 
0862285 
0900781 
0220246 
e2O2072 


2092820 
#298005 
eS0G001 


Az409 


0007447 
0836488 
0289396 


A=108 


0900016 
0399903 


A=2.6 


oBT4274 
0193111 
2251045 
e217572 
0141422 


0873539 
2931867 
0011836 
o203847 
e@O1111 


#220289 
2999968 
09086015 
0880803 
e999901 


Az3e4 


0933373 
0113469 
0192898 
0218617 
0185825 


0126361 
0071604 
0834779 
0614781 
0995584 


0901899 
0000587 
0000166 
0200843 
eOSGO11 


0200062 
0006601 


A=4.2 


0814996 
6862981 
0132261 
0185165 
0194424 


0163316 
0114321 
0268593 
0036011 
0216885 


0007058 
0202695 
250943 
0820305 
0220091 


0000026 
0200807 
«090092 


A=508 


9806738 
0933699 
0884224 


A109 


0889025 
e3DOO04 
0229081 


Ae2 7 


0867206 
#181455 
0244964 
6229468 
6148816 


0988360 
00936162 
06013948 
0894708 
991412 


0000381 
6900094 
€900921 
0020984 
«980081 


Az3.5 


0030197 
0105691 
0184959 
0215785 
«188812 


0132169 
0077898 
0038549 
#016865 
0896559 


802296 
0000738 
0990213 
0000057 
©889014 


0902903 
0089001 


A=4.3 


0613569 
0958345 
012544) 
€179799 
0193284 


0166224 
0119127 
0073178 
0839333 
0018793 


0008081 
0683159 
0061132 
0600374 
2280115 


#380833 
0080029 
90O80R2 
0060201 


A=5.1 


0006097 
#031993 
0879288 


Aa28 


6880038 
@2B0007 
0806801 


A#2.8 


0860819 
6179268 
6238373 
6222484 
0155739 


0287214 
040700 
0216288 
0025698 
o91773 


08930496 
0909126 
€920929 
0988006 
6990861 


An3.6 


@827324 
0298365 
a177958 
0212469 
2191222 


0137680 
0882608 
0042484 
0819118 
0887647 


6002753 
0808981 
8800270 
0228075 
209819 


0200005 
0929991 


Ashes 


0912277 
0954920 
0118845 
6174395 
0191736 


168728 
6123734 
eBTT775 
0342776 
0820913 


9029282 
0003681 
0821352 
0808457 
0900144 


0808242 
0028012 
©80003 
0808001 


Ax5e2 


0005517 
028686 
0874584 


Nee 
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FAnres 


wonauw 


11 
12 


13 
14 


15 


17 


18 
19 


28 
21 
22 


Az4.5 


0168718 
0189808 


01786827 
#128129 
0682363 


0846329 
0023165 


0810424 
0094264 
0001599 
0999554 
0906178 


08000653 
0600915 
090904 
0800601 


Ax#5.3 


0884992 
0026455 
870107 
¢123856 
0164109 


0173955 
0153669 
116343 
eO77BT7 
0945398 


eO24057 
0811591 
0085119 
©692087 
e888798 


0899279 
26060992 
886829 
6090008 
6000002 


0800081 


Ax6,1 


* @892243 


0213681 
0941729 
0884848 
0129393 


0157869 
0169491 
#159856 
0126643 
e872279 


0044399 
0024450 
0®@12429 


0805832 
000254) 


0801933 
0000394 
6000141 
0808048 
0880015 


e8O0905 
o882801 


Az4.6 


0163068 
0187528 


0172526 
0132279 
0286920 


0049979 
0025545 


o021751 
0804914 
9001884 
0230667 
0886219 


6260867 
0998819 
0980005 
0868001 


Aed.4 


0004517 
0824398 
@065852 
01286533 
0160020 


0172821 
0155539 
#119987 
088991 
2848595 


0026241 
0812882 
885797 
00292408 
0888929 


0880334 
00606113 
0868036 
0000011 
0080903 


0208801 


An6.2 


0992029 
0012582 
02392906 
0088612 
0124948 


0154936 
0166100 
#141893 
0109897 
0875707 


0046938 
0926456 
0013669 
0806519 
082887 


4981193 
0002462 
0296169 
0008058 
0882819 


2930006 
af62082 


Az4e7 


0157383 
6184925 


0173838 
0136167 
0891426 


0953713 
0028058 


0013184 
0825633 
0902206 
09829798 
00909268 


0BO0984 
0968925 
0302897 
2800002 


A=5.5 


0094087 
o822477 
6961822 
@113323 
0155819 


0171481 
e157117 
0123449 
0084871 
3051866 


0228526 
0014263 
0806537 
0002766 
02010887 


0889398 
0800137 
e0B0844 
e202014 
eD0OOS4 


0009001 


Az6.3 


0901836 
0811569 
0936441 
0876527 
01285328 


#151868 
0159461 
0143515 
#113918 
0079113 


6049841 
0628545 
0014986 
0987263 
0863268 


0881373 
0000548 
0880206 
e200078 
0282023 


4902007 
oF02282 
0082681 





TABLE 


A=4,8 


3151691 
0162629 


0174748 
0139798 
0895862 


0057517 
0930676 


0014724 
0986425 
#@D2570 
0999949 
0882325 


0000104 
e2SOO31 
02339089 
69S0002 
0020801 


A=5 .6 


0063698 
o820708 
0857983 
6108234 
0151528 


0169711 
0158397 
0126717 
0088782 
2055193 


0830908 
0815735 
0207343 
0893163 
0081265 


0888472 
0289165 
2608054 
0200817 
022005 


0089991 


Aeo et 


6081662 
0819634 
0834929 
0872595 
0116151 


0148674 
#158585 
0144992 
0115994 
02824684 


0052798 
o230714 
0916381 


0008064 
0803687 


0221573 
0028629 
0289237 
0800684 
2202228 


#839809 
eB20003 
90O9001 


4 


1 


Axed 


0146814 
0178667 


01752998 
#143153 
0186267 


0061377 
e933416 


0016374 
8887294 
0882978 
0001123 
0820393 


0000128 
0983939 
0880911 
0996083 
0000081 


A=e5,.7 


0063346 
8019972 
0854355 
0193275 
0147167 


e1677793 
0159382 
0129762 
0892478 
0058564 


0033382 
0017298 
0008216 
0093683 
4221467 


0800557 
0926199 
#800867 
e0O0021 
0000006 


0000852 


As6e5 


0801503 
#029772 
0031760 
0068814 
0111822 


0145369 
e157483 
0146234 
0118815 
0885812 


eB55777 
0032959 
0@17853 


2888926 
eBO4144 


0931796 
0080730 
0288279 
0080101 
0008534 


0986011 
0290063 
e9G0681 


Az5,8 


0149374 
0175467 


0175467 
0146223 
0184445 


0865278 
0836266 


0918133 
0888242 
0883434 
991321 
0808472 


0808157 
0288049 
0800014 
o88O084 
e288801 


Az5 08 


0083828 
0017568 
0058923 
0898452 
@142755 


0165596 
0160076 
0132635 
0096162 
0961970 


0835943 
0018952 
00999169 
6204087 
0981693 


0900655 
o28O237 
00909081 
0989026 
0028208 


0920502 
0200001 


A=6.6 


0001360 
@228978 
0929629 
0965183 
9187553 


9141969 
0156166 
0147243 
0121475 
0089082 


0958794 
0835276 
0919482 


0999850 
0884644 


4282043 
2008843 
0800327 
0828120 
0882842 


eBG0014 
0888854 
e200021 


Az5.1 


0134799 
173857 


8175294 
0149908 
0168557 


086929 
063921 


0020009 
0889273 
0883941 
0281546 
0008563 


0200191 
0008861 
0098018 
0880665 
0088801 


Aw509 


0982739 
0216163 
0047688 
6893771 
0138312 


0163288 
0160488 
0135268 
0099768 
0965398 


0038565 
0028696 
6010175 
0244618 
0901946 


200765 
6090282 
0860698 
0800032 
6208019 


6080003 
0680201 


As6.7 


001231 
0028247 
0627628 
0061762 
0163351 


#1384998 
€154648 
148928 
@123967 
0892286 


0061832 
0037661 
0621828 
oB19837 
0885166 


0802317 
4088970 
0088382 
0800142 
0808850 


2006817 
0898005 
@808882 


An5.2 


8129279 
0168963 


0174785 
0151488 
0112528 


0073143 
0842261 


6621976 
0018388 
0924502 
0991801 
0882669 


0098232 
0880075 
2888023 
68009067 
899982 


An6,0 


0882479 
0914873 
0844618 
0889235 
0133853 


0162623 
2160623 
0137677 
0103258 
0968838 


0841393 
0822529 
0011264 
0805199 
0882228 


0082891 
0900334 
0090118 
08806039 
0920812 


0000804 
0022081 


A=6.8 


0601114 
oOB7574 
0825738 
0058368 
0899225 


0134946 
0152939 
0148569 
0126284 
0995415 


0964882 
0849109 
0822728 
0611889 
oBB5774 


6002618 
0081113 
0008445 
0980168 
9080060 


0980020 
00998807 
0828082 
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5 
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9 








xX 
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A=6,1 


A=6-9 


6901308 
#096954 
6823999 
0055178 
0895182 


#131351 
0151853 
0148895 
#128422 
00986457 


0867935 
2042614 
0824503 
0813805 
0806413 


0982949 
0021272 
0002516 
0220198 
e090872 


080025 
8000208 
6820003 
0008201 


A=7e7 


0008453 
00803487 
0813424 
0034455 
0066326 


0102142 
0131082 
0144191 
0138783 
118737 


0891427 
0063999 
0041066 
0824324 
0013378 


#996867 
0023305 
0201497 
0820642 
e222 260 


0060120 
0080037 
0808813 
0820004 
800001 


A=8.5 


0808203 
e221729 
0807358 
0829826 
0844255 


0075233 


A=6.2 


A=7.2 


0266912 
¢286383 
0022341 
0252129 
0891226 


#127717 
0149883 
0149883 
0138377 
0161485 


0078983 
0845171 
02263508 


0014188 
0007094 


0083311 
0821448 
0000596 
0828232 
©966885 


6220030 
#9O0G19 
6900003 
0060001 


A=728 


0060412 
0093196 
0212464 
0932497 
063193 


0098581 
0128156 
0142862 
0139232 
120668 


0094121 
0266740 
0243381 
e®26629 
€914502 


0987541 
0063676 
0001687 
0800731 
0208300 


0006117 
0290043 
o20202015 
0220005 
0296092 


#966991 


A=8.6 


0280184 
0801583 
0096868 
0019517 
0841961 


e272174 


A=6,3 


A=7,1 


0000825 
6005858 
0920797 
0849219 
0087364 


0124857 
0146883 
0148897 
#132146 
0194249 


0874017 
oB47774 
eS28267 


0015438 
0907829 


0033786 
0001644 
0202687 
6000271 
0@00181 


0020036 
#998012 
2DOGOO4 
2208001 


A=7.9 


206371 
0202929 
0811569 
0936465 
0068169 


0095067 
0125171 
0141264 
0139499 
0122449 


0996735 
0069473 
0045736 
6827794 
0215684 


0988260 
0334978 
0001895 
0002832 
0000346 


0060137 
eO2O051 
0000218 
oPOD006 
098402 


0393081 


A=8e7 


©000167 
0801449 
0696304 
0618283 
8839765 


0869192 


TABLE 


Az6 44 


A=7,2 


0238747 
6805375 
6819352 
0046444 
0083598 


#120382 
0144458 
0148586 
e133727 
0106982 


eB77B27 
2058418 
0930251 


0916754 
0008616 


0064136 
0081861 
#008788 
0060315 
0028119 


0200843 
#299015 
6900005 
0000002 


A=8.0 


0880335 
¢9D2684 
0019735 
0028626 
0857252 


0091604 
0122138 
0139587 
0139587 
0124977 


0299262 
0972190 
0948127 
0029616 
0916924 


0009926 
0094513 
0002124 
0200944 
0860397 


#228159 
#00061 
0208022 
0290808 
2200003 


6020001 


A=808 


0080151 
0001326 
9025836 
0817128 
0037664 


0066289 


I 


A#6,5 


A=7.3 


@S00676 
#294931 
0218800 
0243799 
0079934 


@116783 
0141989 
0148074 
0135118 
189596 


o289065 
0853894 
0032299 


#018137 
@009457 


0004662 
0202180 
0086982 
220366 
0000141 


0289851 
#940818 
o200S306 
e220002 
6G00881 


A=6e1 


9329304 
0222459 
0039958 
0026886 
0254443 


0088198 
0119867 
0137778 
0139588 
0125556 


0101696 
0274885 
0050547 
e231495 
e218222 


0309848 
0394981 
eO@O2374 
0001868 
0090455 


0900184 
6200871 
0800826 
0828809 
0986063 


0980001 


A=809 


0920136 
0801214 
0685492 
0216825 
0835656 


0663467 


A=626 


Ae7.4 


0262611 
0204523 
216736 
0041282 
8076372 


#113631 
0139445 
0147371 
0136318 
01128684 


0282942 
0255797 
0934488 


0219586 
0018353 


2085107 
0002362 
0201828 
0089423 
0000165 


00909661 
0300021 
0020607 
o226882 
0000001 


A=Be2 


#889275 
0892252 
6209234 
0825239 
0251740 


0884854 
115967 
0135848 
0139244 
0126866 


0194831 
0277558 
0252993 
0233426 
0019578 


0219703 
0005485 
0202646 
0201285 
0009520 


0208213 
0029083 
0200831 
0280811 
€209G04 


280801 


A=9e8 


0000123 
001111 
0204998 
0214994 
0233737 


0069727 


Az607 


A=7.5 


0000553 
0084148 
0215555 
09388869 
eS72916 


189375 
#136718 
0146484 
#137329 
0114449 


0085830 
258521 
0636575 


08211081 
0811304 


6905652 
6882649 
#901169 
0090487 
8809192 


@BBO972 
0823826 
0890009 
#802903 
0280001 


A=8.3 


#226249 
862063 
0028560 
2023683 
0049142 


0081576 
0112847 
0133805 
0138823 
0128825 


0186261 
0082179 
0255457 
0835407 
0926991 


0011615 
0906625 
9002942 
0021357 
0000593 


a@2S246 
eO00097 
eB8O037 
@200013 
0900005 


eB00082 


A=9el 


0286112 
8001616 
0804624 
0014925 
0031996 


0258869 


Az6 8 
0980001 


Az7.6 


0800500 
283803 
0814453 
0836614 
0869567 


0105742 
01339468 
0145421 


-€138159 


#116669 


0988661 


0061257 
0038796 


0922681 
0912312 


0806238 
0002963 
0001325 
6290559 
0000224 


6092085 
#999031 
#000011 
@9BDBO4 
0P0OG01 


An8 4 


200225 
0001889 
0887933 
0822213 
0046648 


0978369 
0109716 
#131659 
#138242 
0129826 


0108382 
0082764 
0058035 
0237435 
0822461 


0012578 
0206604 
0003263 
0281523 
0808673 


e800283 
8000113 
0888043 
0800016 
¢290006 


e22O0G2 
e822801 


Az9e2 


#800101 
0809939 
0984276 
0913113 
0039169 


0855494 
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wonnvau 


A=8.5 


#106581 
@129419 
0137508 
#129869 


o110388 
0985300 
0060421 
0839506 
0023986 


0213592 
0007221 
0023610 
0021705 


083763 


o9O0324 
0800133 
0090951 
0822019 
0809007 


0088282 
ef20001 


A=9e3 


0800091 
0000859 


0823954 


0812256 
0028496 


0853002 
0082154 
0189147 
0126883 
01321113 


0121935 
41032990 
0879895 


0057156 
0837968 
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50031177 


0824942 
0019467 
0814832 
2911038 


@OO8027 


0995738 
0823971 


0082704 
0201802 
0861177 


e862753 


0888473 
#906291 
0080176 
0209104 


0002061 
0886035 
0000019 
6060011 


0860006 


0868003 
eOO0G02 
@288501 


A=46 


0882302 


2080893 
6960009 
e60621 
0293046 
e880096 


0980192 


30090366 
0888665 


0901156 
0801927 


aGG3084 


0004744 
0907628 


0819941 


TABLE 


Az33 


02195388 
0015192 
0920889 


9827573 
2934997 
0242774 


0858412 
e@57365 


0863122 
0267173 
069272 
0969272 
0867234 


0963392 
0858112 
0051828 
0045088 
oO38084 


0831419 
0825289 
0019876 
0815249 


0811437 


0208387 
0806017 
0004224 
6082984 
6901956 


0001291 


0899835 
0980530 
e2O0330 
499D292 


0000121 
0802071 


0002041 
0888023 


0900013 


0220207 
ePO0O24 


0982GB2 
6999001 


0982801 


Az41 


0020061 


ePO2HG2 
eO00025 
0009611 
0999826 
0000056 


0899116 


0000226 
0880421 


0060751 
0881282 


9982183 
0803317 
0905836 


0897375 


479 


t 


A=34 


0897512 


0011195 
0915732 


0821395 
0827978 
0035232 


0242782 
0658158 


0056845 
€262347 
0066243 
0068251 
0068251 


0866301 
0062617 
0257546 
6951483 
0644883 


0838158 
0031637 
0825611 
0820250 


0915648 


0011823 
0898739 
0806322 
0204478 
0983127 


6982113 


0981489 
0900921 
0000591 
0220372 


0229230 
0390140 


00008083 
0000049 


0090028 


290016 
6028009 


029G005 
0200883 


0026001 
0990681 


A242 


0822001 
6209503 
oDOO006 
0299815 
0028033 


0809969 


6200138 
#828263 


208481 
2200841 


0881413 


0902283 
0083551 


08995327 


Aw35 


#985229 
0207957 
0911684 


9016246 
0921870 
028359 
0035437 
6842769 


0849897 
0256335 


0261617 
2965351 
0867273 


0867273 
0865404 
0961869 
0856985 
0251148 


0844748 
0938199 
0031833 
0825910 


0820610 


0916039 
0912197 
0899083 
0096623 
0904731 


0983311 
0082273 
oBO1530 
001618 
0260655 


6800417 
0000260 


0200166 
02082896 


0200857 


2888833 
«900819 


0200011 
22606026 


0228083 


02086662 
2866661 


As43 


9288881 
0220001 
0022083 
0928088 
0200819 


0858041 


0980883 
2998163 


2000304 
8200544 


2208936 


0281548 
0802466 


oOO3787 


Aa36 


0083575 
0095596 
0868394 


20812087 
0816736 
0022314 
00286928 
0635615 


06842738 
0849631 
9055835 
6066911 
0064494 


0066337 
0066337 
0064544 
0061147 
0056443 


0058799 
0344604 
0938232 
0032068 


0926188 


0026951 
6816396 
#812559 
8689419 
0006928 


2904983 
0003517 
2092435 
0001654 
0001103 


0000722 
0890464 


0808293 
0000182 


0000111 


ePOO067 
80828839 


820023 
0800013 


eBOBOR7 


8220004 
099992 
4628901 
€229091 


Arhs 


9080081 
8900002 
92O2005 
0080011 


6388924 


0880050 
0889999 


0880190 
8006348 


6008612 


6961036 
0901688 
0002652 


Az37 


0992493 
0963866 
0605960 


0908821 
6612552 
6617282 
0822731 
6929861 


0035768 
0042691 


0649361 
0855345 
0860228 


0963670 
0865438 
0265438 
¢063716 
0969449 


@955915 
0050460 
6044453 
¢0382508 


0032165 


4926447 
0821272 
0016746 
0812989 
eB89747 


@267213 
0865233 
0003723 
0862599 
0061781 


0001198 
0802792 


0889514 
0099328 


0600206 


0060127 
0200077 


0980046 
800027 


0O0SO016 


0290009 
@99S905 
@29B9O3 
6996001 
6029601 


Ass5 


4260001 
0692053 
o8B0SS6 


6800014 


9200029 
0980060 


0080117 
0906219 


*800395 


0092683 


0981139 
0601832 


12 
13 
14 


15 
16 
17 
is 
19 


20 


21 
22 


23 
26 


25 


26 
27 


28 





17 
18 
19 


28 
21 
22 
23 
24 


25 
26 


28 


Az38 
6823120 


0829286 
0035899 
0842639 
0049089 
0054864 


0059567 
0062876 
0864575 
0064575 
0262919 


0859773 
0855408 
0050124 
0844295 
0838255 


0832304 
0826686 
0821576 
0017081 
0013246 


0010867 
0097591 
0805482 
0093930 
0892766 


0001911 
0001297 
8000864 
2290566 
2088365 


0090231 
0999144 
0002988 


0900053 
0098932 


0090018 
0800011 
oO9S8C6 
0802083 
0898002 


020081 
0008091 


Ax46 


20909801 
0060501 
0600003 


0860868 
e009017 
0200036 
0690271 
0908137 


0880252 
0800445 
0000758 
0891246 


As39 
0918865 


08923485 
0229546 
¢836009 
0042556 
0048814 


0054393 
0958926 
0962111 
0063746 
0863746 


#062152 
0959120 
0054897 
0849791 
0044133 


0838248 
0832428 
0026988 
6921863 
e817401 


0013573 
0018379 
0807784 
0905728 
0064137 


0602934 
0982043 
0901398 
00889408 
#800621 


0990404 
0896258 
0800162 
0200101 
0380861 


eO0OO37 
00908822 
0989913 
0880007 
0890004 


0959802 
0998821 
0980991 


A=47 


0996001 
0888882 


029DOG4 
0068010 
0863921 
0398043 
0800084 


08008158 
0000286 
0208499 
0880837 


Aung 
0813849 


0218465 
0823826 
0829783 
0036101 
8042471 


2048539 
0053932 
9958305 
0961373 
0062947 


0862947 
0961412 
0058487 
6954497 
0949461 


0043965 
0®38231 
0032537 
0627114 
0822134 


eG17787 
0913888 
#210683 


0088663 


0985972 


0994343 
0883182 
0862177 
6901582 
0010618 


o288679 
0000445 
0600287 
200182 
0800114 


9988070 
0008642 
0098825 
0000015 
09020089 


0688005 
0838093 
08928B2 
0090001 


A=48 


0882801 


0899282 
0868806 
0909912 
©9026 
0860051 


0860099 
0898182 
0980324 
0900555 


TABLE 


Awz4l1 
0018426 


0814249 
0818845 
0824146 
#829999 
0036175 


0642377 
0948263 
0253480 
eO57702 
0260661 


0862178 
0@62178 
0968697 
0957874 
0953928 


0849135 
0843794 
0038293 
0232632 
0827394 


0822389 
0817999 
08014192 
e810979 
0808336 


0006214 
0894549 
0883272 
0092313 
0801607 


6001998 
0000738 
6090488 
0092318 
0088294 


0088128 
2880680 
0280049 
2608029 
9080017 


0808010 
00988606 
@B00083 
2080802 
8900001 


0999601 


A249 


0280081 


0989801 
0280003 
200007 
0908615 
0293831 


0896061 
4802115 
0809268 
0202364 


480 


I 


A=42 
e807715 


0210801 
08914633 
0919296 
0224444 
0030196 


0836235 
0042274 
0947986 
0253838 
0957117 


0059973 
0861436 
0061436 
0969307 
6957280 


0053461 
0048812 
09436290 
eS38167 
eG@32715 


0827489 
0822631 
0018279 
0814485 
0911266 


0088603 
2986452 
0804754 
0983443 
0092451 


0801716 
0901181 
0989888 
0899533 
0900356 


0080226 
0880144 
0000090 
8098056 
0000234 


0000020 
0668012 
e220087 
0B20084 
0920082 


0999001 
0880991 


A=5é 


0990901 
ef80002 
0820054 
eD2DOB9 
8808219 


0020037 
e980071 
0990132 
0998236 


Az43 
0885615 


0298049 
0811164 
#215082 
0219548 
0924723 


eB3O374 
0036288 
0842163 
eB47711 
0852684 


0056559 
6059308 
0868720 
0268720 
0059340 


0056703 
0253065 
0948494 
0843442 
0038123 


0032786 
0827643 
0622859 
0@18546 
0014768 


0811546 
0808865 
6806688 
0204958 
0803614 


0262598 
6901826 
0961266 
0808864 
0268581 


0880384 
0280250 
0200161 
0206162 
0080063 


0888839 
82090624 
0820014 
2980608 
©208605 


0068003 
o2OG8G2 
0208861 


Ae51 


02090001 
0388862 
0200GG5 
00060011 


0800622 
0996644 
e800683 
0200151 


Ares 
0004024 


0885962 
o968376 
0811517 
0815357 
0019873 


0824984 
0930535 
0036312 
0842946 
0947436 


0852189 
#055998 
0858665 
2969629 
6260629 


0058695 
0056143 
0852559 
048189 
6843263 


0938872 
0832846 
0927793 
823673 
0818880 


0915840 
0811817 
0969122 
0036928 
0005161 


0803785 
6082730 
0021937 
0021353 
9098938 


6880630 
0989429 
8008276 
0000178 
0000114 


2808672 
eOPOD44 
2800027 
2600016 
0060012 


69BOGG6 
€993803 
@820082 
8029001 
0989801 


Ae52 


0983801 
0000091 
60809903 
0080986 


0290013 
6680827 
6800051 
120096 


An45 
0802849 


0004261 
#986185 
0808697 
0811869 
0215697 


0920182 
08625227 
0830681 
6836333 
6041923 


0047163 
o651765 
0855462 
0058042 
0659361 


0959361 
0058070 
0855599 
0652124 
6047869 


0043082 
0838014 
0832897 
0627931 
0023276 


0819944 
0215303 
012981 
0809374 
0897149 


0805362 
0803956 
682871 
0992051 
0991442 


6806998 
0909681 
0990457 
©000383 
0800197 


0808127 
2200088 
2800058 
6000031 
0290619 


0090011 
0998007 
eB2B004 
6925902 
¢808901 


000901 


A253 


0988091 
o889002 
8092004 


«299008 
998816 
#990032 
«200069 


23 


A=46 
0981976 


0003031 
084497 
0096464 
0089011 
0012191 


0816423 
oD20474 
0825454 
0830813 
0636343 


0041795 
0946892 
0851358 
0A54941 
0057438 


0958714 
0058714 
0857465 
0055871 
#051699 


2047563 
6942980 


4937950 


28329368 
0028058 


0023467 
0019276 
0015556 
0012338 
2969619 


0807375 
00095561 
0004126 
0823013 
0062165 


0001532 
00091968 
6880733 
0000496 
0080331 


0808217 
e8O814) 
o2O089% 
oPOOS57 
0080935 


28O9B22 
©88OG13 
0993808 
088G905 
©888083 


2OOOG02 
09B8G01 


A=54 


6688001 


A=47 
0061357 


0062125 
0963222 
4094733 
0906741 
0969318 


0012513 
0016336 
0920751 
0225666 
0630931 


0836344 
0941662 
946622 
0f58959 
6954433 


0056853 
0858089 
0058889 
0956878 
0854557 


6051283 
6047261 
0942717 
0037861 
0032971 


0028175 
0023647 
00619498 
0015800 
0012587 


0009668 
0037597 
0085759 
0884296 
eO03155 


0062281 
0061625 
6001140 
6998788 
0800537 


0008360 
00408238 
0800156 
0980190 
0906064 


6090040 
a%OOG25 
0660615 
0930509 
08S4005 


2189283 
ePONGA2 


0008061 
0960001 


A=55 


0006021 


A=48 
¢990919 


0851476 
eB8A2277 
eOA3415 
0994968 
0007613 


«999618 
0912824 
0916636 
0821814 
«225864 


0231036 
0936335 
0041526 
046354 
0354568 


@353946 
0856285 
0257482 
0857482 
0256389 


0254957 
0258877 
0346964 
0842533 
o837807 


0632995 
0628282 
0023816 
0019710 
016635 


0912828 
0718094 
0207815 
0085954 
0004466 


0083298 
0962398 
0991718 
0861213 
oOS2844 


0988579 
0000391 
08686261 
0600171 
eOOO111 


0064671 
@FOO845 
2068928 
0938817 
o3BAB1O 


aA BO006 
eDAGA4 
©BO2002 
eAGADHL 
08864001 


A=s5S6 


TABLE 


A=49 
9800615 


0901804 
0001587 
8902430 
6893699 
0885291 


o007281 
0829918 
o913125 
0216924 
0821263 


6%26948 
0031130 
0936318 
0041386 
0846989 


0950186 
0953459 
0855734 
0956895 
0256895 


oO@55757 
0853578 
0253480 
9046673 
0842349 


@O37729 
0033013 
#628379 
0823976 
0919912 


2016261 
0013963 
0019324 
0998229 
0906148 


0004634 
0993441 
0862516 
#801813 
0061288 


©800991 
#BA8622 
0900423 
0289284 
#999188 


6900123 
e86O079 
o83AG50 
o9OFA32 
0990029 


0698812 
#09007 
eBAGADS 
#899003 
oABAGA1 


#888802 


A=57 


481 





1 


A=56 
@4G6406 


0890677 
0631992 
0901787 
0942586 
0863803 


0405432 
e2AT7545 
0810196 
0813416 
08172208 


0421500 
0026219 
0031213 
0836294 
0841244 


0845826 
0049811 
0852991 
0855199 
0856325 


0856325 
0955221 
0953097 
eB50A91 
0846381 


0042164 
eB37647 
0933023 
0928468 
0024126 


0820165 
0816479 
0813298 
oB1D547 
e9D8240 


0846339 
6864862 
0893584 
0882635 
0801989 


00901364 
0890960 
0000667 
eBAA45T 
2889359 


08O0S2H6 
0960135 
0990088 
eB0OO56 
eADAA36 


6080622 
089614 
489968 
2F08G05 
aAAAAA3 


e8SAGa2 
0808001 
0000001 


A=51 
0246265 


09560451 
#908742 
0081183 
6991829 
09O2743 


0803997 
0905662 
0837804 
o21B476 
0813697 


0017464 
621723 
0926379 
0931286 
0936264 


0941999 
0945566 
0049444 
0952534 
0054678 


eB55772 
0955772 
0954699 
#952635 
0049711 


0746696 
6441980 
0037561 
0033628 
0028549 


0824267 
0820289 
216689 
08135168 
eF1O766 


eOB8447 
0986527 
6894969 
0063726 
0982754 


6982697 
0981441 
0961621 
@990713 
0998492 


0980334 
o9BG224 
oO84149 
08238997 
60986063 


0988640 
090825 
0996616 
09OO8146 
sADAGBE 


eBAADAS 
09048602 
00086001 
0296801 


A=52 
0208171 


#980297 
6906499 
6000818 
e801277 
0901953 


0262981 
0404191 
¢805889 
0828859 
aO1A746 


0013969 
0617717 
#821936 
6926527 
6931350 


0936226 
8848952 
0045308 
0849984 
0852689 


0054173 
0855235 
6955235 
0854193 
0852185 


6449339 
0845815 
6041795 
aO37472 
6833826 


0828623 
6824480 
0820464 
9016891 
eG13724 


6818979 
06686598 
e806714 
90085134 
0063869 


0062874 
6002185 
€9015206 
0801083 
0486761 


6800528 
0900361 
eBAG244 
6830163 
eOAG1AT 


eOOAB7H 
0999045 
6990628 
6840018 
oABAGLL 


6899087 
OABAOAL 
6820082 
0208001 
6880001 


A=66 


Ae53 
0060110 


0908194 
0986331 
0220548 
6909881 
901373 


0802679 
0633669 
6994384 
8886114 
0828399 


0011018 
0014232 
0817960 
0822136 
0326664 


0831405 
0936184 
8844803 
0045053 
88948731 


0051655 
6053681 
8054713 
0954713 
0853706 


eB51747 
0048975 
0045538 
6041612 
0837381 


0033019 
0828689 
0824524 
0f28632 
0017086 


0013931 
€011187 
8998859 
0006898 
0035298 


0064011 
0602994 
e8O2204 
eAO160R 
0981146 


09890810 
ofO0565 
0990389 
0480264 
oBO8177 


0080117 
eBOO077 
0680058 
0AAGA3S2 
e88AR20 


eAADAL2 
0888008 
aBOAE85 
0890003 
0899802 


0220201 
0880091 


. An61 


23 


A=S4 
#899952 


9888885 
09998198 
0808919 
0382937 
0080069 


0802125 
0000217 
9808367 
0809690 
0890954 


0001471 
oOS2207 
#283221 
0094577 
0886337 


0828555 
0011267 
0014486 
0218192 
0222327 


0826792 
0631451 
6036136 
6940653 


0044601 


0048385 
0051231 
0953202 
0054205 
0054205 


0053226 
0951319 
2948618 
0045265 
0841429 


oO37286 
0033008 
0828748 
0024642 
0820791 


0017273 
#014132 
0211398 
0989045 
0287879 


0995461 
0904153 
0093115 
2882304 
0021631 


0801211 
afD0862 
4980693 
0900418 
0888285 


#999193 
0980128 
0820085 
0820855 
0888035 


0888022 
0020014 
6080899 
0200005 
8099883 


aBBOOG2 


Aa55 
0330881 


0860803 
o9B20G6 
9966212 
0886023 
06802843 


0980088 
0608141 
2085243 
2900403 
0980655 


0821829 
e6S1S72 
0282336 
0023381 
0204768 


2886556 
0838798 
0811518 
0214732 
0918415 


0822507 
29269198 
0031492 
036283 
0640501 


0844552 
02488646 
0050818 
0852735 
6253712 


0053712 
0052753 
0050902 
0048269 
0044996 


0941247 
0037198 
0932991 
0228802 
0824752 


0826943 
0017453 
08614327 
0911588 
0939237 


e867 257 
0985622 
0894295 
0883236 
4082495 


0901764 
0881276 
0906912 
eBOS643 
0889448 


oFG8308 
2990209 
0030148 
0888893 
0006061 


0880039 
0020925 
0290016 
0000019 
0888086 


o800004 


Ax=56 
0822991 


e889S62 
68G9SS3 
oBOD907 
0880014 
0080027 


0880058 
0060891 
0880159 
0082275 
0998454 


eOOO711 
0601106 
s001674 
0992467 
0983542 


0004959 
0606773 
0009831 
821761 
0614969 


0218628 
0622677 
0227020 
0831523 


0036026 


0848349 
6044305 
0847713 
0050414 
0052281 


0053232 
0053232 
0052298 
@059494 
0847927 


0044732 
0841465 
0037691 
6032970 
0828849 


0024854 
e821888 
0217626 
0014516 
0911781 


0009425 
oB27434 
0855782 
0864435 
0003356 


0992506 
0801847 
0901343 
e883964 
0830683 


9292478 
e890331 
0800226 
0888152 
09901982 


0802067 
0808044 
0060828 
0000018 
0960011 


0890207 


TABLE 


A=57 


0000001 
0699002 
0803004 
0002088 
0660017 


0222832 
0098058 
09951083 
0892178 
2923298 


0606486 
0080769 
0801185 
o801778 
0282599 


0803783 
0885148 
8806987. 
0®29262 
0811998 


08315197 
0818832 
022838 
0827121 
0231548 


0935965 
0840196 
0944961 
0847387 
6058919 


0051838 
0852764 
0852764 
0851854 
3052097 


0247592 
0844471 
0048885 
0836991 
0832945 


0828896 
0824951 
0821227 
o@17793 
0214698 


0911969 
2889609 
e2B7687 
08659428 
6804575 


aDB3477 
2222688 
6981930 
0001411 
#981018 


0802725 
0090510 
0800355 
eB88244 
0900165 


880111 
0288873 
2022048 
0080031 
0892220 


4880213 


I 


A=58 


0800081 
0888081 
0888082 
0290985 
00028010 


aBP8R22 
9OO8O36 
eO8S266 
0808116 
0960198 


0808329 
0899529 
e8888308 
0001267 
e8818846 


o882731 
0003864 
0685336 
0027197 
0029488 


0812228 
0015418 
0819827 
822991 


0827214 


0031568 
0035901 
0840943 
0043821 
0847067 


0049634 
0951467 
09523868 
0852308 
0051422 


0049788 
0847263 
0944214 
0946785 
0836889 


832916 
0828926 
0825061 
0021358 
0817953 


0014876 
0012152 
0989789 
0667778 
0886096 


0084714 
0283598 
0802710 
0802815 
0881479 


#291073 
0990768 
0080543 
a68838¢ 
0808262 


0029179 
e060121 
o200080 
0206053 
0892035 


eB08822 


Azs9 


e800001 
0286001 
©20G0O3 
o208086 


0208012 
0888023 
0888842 
eBO2075 
0996139 


6908220 
0809360 
oPPE575 
6986892 
0861350 


0061991 
0802865 
2884825 
985522 
0267405 


0889799 
0812452 
0915632 
0919214 
0023135 


0827299 
0031582 
0935833 
0939889 
0943583 


0846753 
6949257 
0056985 
6851865 
0951865 


9851060 
0849328 
0846941 
0943961 
0048526 


0936785 
0932884 
0226958 
0025125 
2021484 


0918188 
0015047 
0912330 
2889966 
0087946 


0086258 
0284852 
e983718 
e@02812 
0882166 


0921549 
0981128 
0088812 
eBSO577 
0288495 


0806281 
0980193 
2288131 
«608868 
0880058 


0803238 


An63 


0882001 
€880062 
0280904 


«886807 
0880014 
0896926 
0008048 
6889985 


8086146 
0966243 
#BBQ394 
0882622 
0983956 


0621435 
06022399 
0682999 
6884185 
0805757 


0987609 
0689925 
#212878 
0915837 


0819393 


0823271 
0827378 
0631598 
0935762 
e839736 


0843348 
0246464 
0648889 
oO5O575 
00514632 


9051432 
#959589 
0848957 
0846625 
0043711 


0849349 
#83668) 
0232849 
6928984 
0825263 


3021683 
0018256 
0015213 
0812564 
0819138 


#898111 
6896403 
0884998 
0903838 
0682915 


00062186 
0091619 
0981185 
890857 
0688612 


0880432 
0880301 
0098268 
0880142 
0090096 


0808264 


Ae61 


e868001 
e898002 


0880904 
0988609 
o889017 
9928832 
e809055 


0888096 
68990162 
0090267 
6898629 
6000678 


9981022 
0001521 
0092209 
6803134 
6964345 


0965889 
0967610 
0818136 
0012881 
0816036 


0819564 
0923480 
0627450 
0931593 
0835689 


0939582 
0043116 
0846142 
0048528 
0859173 


02518128 
0951019 
0859187 
6648594 
0846316 


0643466 
0846173 
oG36575 
0932812 
0829006 


8225277 
0621717 
0018399 
0615374 
0812673 


08163068 
0928273 
06965546 
€905126 
0003958 


9983018 
0892273 
0861691 
0881243 
0898902 


6890648 
0860459 
0996322 
0880223 
e088153 


0808104 


Aa54 


0049001 
0880001 


Aw62 


0880001 
0808801 


0809803 
0290905 
088909190 
0806019 
0888035 


0020062 
0000107 
0880179 
0080292 
2880465 


e6OG721 
0801099 
0081609 
0892320 
0883269 


0004504 
0986970 
©688007 
0018343 
813087 


0816228 
0819728 
0023521 
0827516 
0931592 


0235613 
0839428 
0842887 
0945845 
0848176 


0849782 
0050598 
0050596 
0849795 
0848238 


0846012 


0843223 
08399986 


0836469 
0832769 


B29824 


0825345 
0621825 


0918536 
0015532 


0012838 
0010473 
0888433 
0996793 
0885261 


0864077 


Az55 


0082002 
0826801 
o880801 


A263 


0086001 


6889082 
0086003 
0020096 
0680012 
0288022 


0880040 
e000070 
0808119 
0280198 
0802319 


4282523 
0890773 
981159 
0061698 
0082431 


0883404 
0804662 
0886249 
0268201 
0819545 


0@13286 
0216412 
0219884 
0823636 
o@27575 


0831586 
0835534 
0839275 
0042661 
0945553 


e047831 
0849399 
0250196 
850196 
0049411 


0247891 
0045714 
0042985 
0939824 
0936361 


e@32725 
0029038 
0325408 
6021927 
0818668 


015681 
0212999 
0812635 
0698590 
0806850 


0005395 


A=56 


0800504 
0202503 
e2GO062 
4088661 


2@09001 


A=64 


0066001 
0990882 
0008804 
0280087 
0882014 


0080826 
0000845 
0880879 
0289132 
0688217 


08@S0347 
0080542 
0009826 
0081238 
0801788 


0802546 
0883539 
0094819 
0886425 
0888392 


0618742 
0013488 
0216591 
0020634 
oO23744 


0027629 
eO831576 
6035454 
0939122 
0852437 


0045266 
eB47493 
00499825 
0849693 
0849893 


0949037 
0047552 
0845422 
0842758 
0939652 


0836253 


0832679 
0829648 


0025467 
eO22825 


0618795 
0015827 
0213155 
0818794 
o208744 


0826996 





TABLE 


Az57 


092098 
0820085 
e9O2003 
e2O0092 


0000201 
0899251 


A#65 


o88G881 
0099801 
0088202 
#220005 
a202989 


e200016 
6289029 
0008851 
#2092088 
2092146 


6880238 
0889377 
0000583 
0000881 
0881392 


690188 
0002656 
0803674 
0894975 
0886599 


0808579 
0918934 
8013668 
0016763 
0820177 


0023846 
0927678 
#031563 
0035372 
0838969 


0842217 
0844995 
0847162 
0848659 
0249419 


0849419 
0848671 
0847218 
0845135 
0042518 


0039481 
6236145 
0832631 
0829855 
825521 


622118 
0218917 
08155969 
08133987 
0816949 


208896 


483 


A=58 


0800014 
0888089 
6800006 
0993683 


e8OS002 


028088 
089880 


A=66 


0008801 
0888061 
0890003 
0000005 


08868018 
0880019 
0920833 
0206058 
2900998 


0800161 
0888259 
0980427 
6908625 
0828937 


00801375 
0881972 
0882776 
0093809 
0085130 


0006772 
@928763 
0611122 
0013851 
0816929 


6020314 
0823942 
0827722 
0931546 
6935288 


0938817 
0241999 
0844789 
0946838 
0948361 


0949944 
0049844 
8848312 
0846891 
0044853 


0842298 
0039312 
0236036 
0832589 
08298058 


0025571 
9822206 
0819834 
0816166 
0013455 


0811161 


An59 


0969625 
2900016 
2000010 
s286006 


0206004 
0880802 
0886801 
0980001 
0000001 


As67 


2089881 
3006062 
0908003 


s0O80006 
«806612 
0880821 
0808038 
0890065 


0099108 
0880177 
0888282 
0888439 
0890668 


0008995 
0881449 
0802066 
0802884 
0893943 


0005284" 
6986941 
0088944 
0011386 
0214028 


0817088 
0820445 
0824932 
0827761 
0832525 


0835203 
0038666 
0841784 
0044437 
0946529 


0947951 
0848678 
0848678 
0947962 
0846572 


0944576 
0042065 
0039144 
0035926 
0832528 


08290658 
0825617 
0922299 
e819147 
0816238 


0813638 


An6s 


6068042 
0800927 
0800018 
6090011 


8220087 
9060004 
6868293 
8809202 
0806991 


00G8001 


Ané8 


e800001 
9062062 


6009004 
0909007 
0690014 
6989024 
0898042 


eO8OG72 
6880119 
6899193 
9988305 
0909472 


0099713 


0691054 
0801525 


0882169 
0682998 


6894077 
0005436 
0897109 
0009121 
0911485 


0014288 
0617243 
0820570 
0824117 
0827796 


0831592 
0235117 
0838515 
0841572 
0044178 


0846269 
6847609 
0948320 
0048320 
0847619 


0846259 
0844364 
8041843 
0938977 
€035817 


€632474 
0829855 
0025659 
08223793 
0819255 


0816367 


Az61 


0960072 
0990046 
2099830 
6809028 


6999013 
e89g008 
0880805 
e898003 
0088862 


0800001 
0660601 


As69 


0800001 
2898001 


8890802 
eeeseos 
0880009 
0999016 
0896027 


eB8C047 
20699080 
0986131 
08902106 
0880330 


8860506 
6690759 
0661114 
0661602 
0802255 


0863112 
0604211 
8065587 
8807274 
0869294 


611668 
0814367 
0817391 
08296905 
#824197 


0827826 
0931475 
0835929 
0838365 
0841362 


0643988 


0845904 
0847274 
0947969 


6847969 


0847284 
0845952 
0844937 
6841624 
0838812 


0035787 
0832418 
#8290568 
6825698 


- 822443 


6819359 


x 


91 
92 


94 


95 
96 
97 
38 
99 


126 
181 


81 
82 
83 
84 


85 
86 


88 
89 


90 
91 
92 
93 
94 


95 
96 
97 
98 
99 


169 
101 
162 
163 
184 


105 
166 
167 
168 
169 


116 
111 


A=62 


#883122 
0092360 
0801763 
0601361 


0820949 
0922684 
0888488 
0200343 
0889239 


0889165 
0000112 
0808076 
0289959 
0800033 


eSO8022 
0990014 
©660909 
eB00006 
oP OB004 


888002 
eCOCG01 
e8SO001 


A=78 
0000001 


300001 
2820003 
080005 
0080010 
0860018 


000631 
0000053 
28806988 
0BB0144 
0999229 


0906356 
0090541 
eB22806 
0091175 
0821679 


0082351 
0823227 
0984343 
0805737 
0087436 


0999465 
0011831 
0014529 
0817535 
0020894 


0924271 
e827852 
0031446 
0034948 
«838216 


0041156 
0243650 


A=63 


00864196 
0883224 
0002447 
0801835 


08013628 
0228996 
0860722 
0260517 
08929366 


0288256 
0080177 
0008121 
2060082 
0998955 


e802837 
0880824 
0298916 
#06910 
0990006 


eS 00004 
0330993 
eS20082 
ef00601 
0898001 


A=71 


0080001 
0260082 
e080003 
0880006 
0008811 


0200020 
0298835 
2800259 
0209897 
0000157 


0222 248 
0800382 
0880578 
0880854 
0881238 


0881758 
0882447 
0883341 
0004476 
0065885 


of37597 
0009631 
0911997 
0014686 
0@17673 


#826913 
0824341 
0827875 
0831415 
0034851 


0@38267 
0649951 


AR64 


0085527 
0884314 
0893326 
0882534 


0221928 
0021428 
2601045 
e06076S 
0290546 


8820389 
0800273 
0826199 
0000131 
@908989 


0900068 
0880040 
0990026 
0920017 
0898911 


ePOO007 
082905 
2008083 
oSB2S02 
2960081 


0968081 


A=72 


0020001 
0080001 
eSO2002 
8080004 
e200807 


0200013 
0000923 
2968839 
0090065 
0098107 


0080171 
0008268 
2860410 
0980615 
08086994 


0081301 
0881637 
0882544 
0903455 
0864687 


0886931 
o@S7754 
00069795 
0012159 
0914839 


0617806 
2621017 
00244387 
0827894 
0031381 


2034762 
037926 


TABLE 


As65 


e067139 
0825659 
02864432 
0083429 


0082622 
0221982 
0001481 
0061694 
9828799 


eBO2577 
9080412 
0892291 
0280203 
080141 


#8900096 
0282365 
©900G44 
0880929 
0280919 


#200012 
8888098 
0888205 
0980893 
0880092 


0392001 
ePO0801 


Az73 


0080801 
6060001 
0PDOGG2 
0000005 


0230208 
0020015 
0823926 
0889043 
0280072 


0890117 
0880186 
0208288 
0280439 
0000653 


0080954 
0061366 
0801917 
0902641 
0803570 


0204738 
0026176 
08879198 
0209955 
0912318 


#814986 
0017935 
0821117 
0824468 
0827989 


2831344 
0834669 


484 


A=66 


0209045 
38272828 
0885789 
0084549 


0083532 
98827108 
0602056 
0881542 
0801144 


0880839 
0000628 
0980436 
0008312 
0080217 


0880151 
0000184 
o800O71 
0892948 
0020332 


0000021 
0000014 
0080009 
0090006 
0800904 


0808682 
0202601 
0900601 
0920001 


A=74 


00O0001 
0006601 
e2OS903 


0906505 
0889209 
#990917 
0889929 
0988948 


0238879 
0000128 
e280261 
0900316 
0000468 


2029693 
00810805 
0921432 
0001998 
0882738 


0093684 
0234868 
0886319 
0988963 
o818112 


0812472 
0815130 
0918058 
0821211 
0824526 


eB27922 
0231306 


A=67 


0811249 
0889191 
0887419 
0985918 


0824665 
0883634 
0892799 
0002131 
eB21684 


2821194 
2862879 
0806640 
0880461 
860329 


0869232 
0208162 
0800112 
o2OS076 
0880052 


0809035 
0838623 
0260815 
206616 
200066 


0005004 
#220023 
0200862 
0808001 
0009001 


A=75 


0200081 
289862 


206083 
0292006 
0880011 
0286619 
0969032 


0908053 
e2D8087 
0288139 
0206217 
0289333 


2869499 
0860733 
0901858 
0081497 
0882879 


0882835 
0803797 
0804996 
0606461 
0888213 


816266 
0012623 
0015269 
o918178 
0821382 


0824579 
0827931 


A=68 


0213742 
0811394 
0999335 
0807557 


086945 
0804786 
6883736 
0082887 
0882286 


0201667 
0981245 
3903921 
0800673 
6900487 


0900349 
€8988247 
6860173 
0200128 
0268982 


0090056 
6908038 
8808025 
80900617 
0006611 


0900087 
9000005 
2080083 
0028902 
2000001 


00080801 


A=76 


0002081 
0829001 


0800282 
0208904 
0880007 
0008012 
0800921 


0900036 
0920659 
2202095 
0090151 
0888234 


0090356 
8808530 
0890775 
0801111 
0801564 


0892161 
0992933 
0093911 
0805124 
0066621 


6008361 
eB10417 
0012769 
0815494 
0818292 


0021386 
0024629 


A269 


0816491 
0813876 
0011536 
0869476 


0807692 
0086172 
0804895 
2903838 
0882975 


0992281 
0001730 
0001297 
0986962 
©983787 


0660513 
0990369 
6996262 
0000185 
800129 


08008089 
0090061 
0008041 
0002628 
0000018 


0002012 
0000008 
2890085 
ef20083 
e860002 


0806001 
e820001 


A=77 


090021 


0008001 
e89GES2 
0093004 
0990808 
08808014 


0899024 
0060048 
eOOO065 
0928104 
0000163 


0880252 
0999382 
880563 
0006817 
00912165 


6601632 
0BO2244 
0003831 
0804024 
0085251 


0806739 
0698567 
6010565 
0912912 
0015535 


0818433 
0821476 


81 
82 
83 
84 


85 
86 
87 


89 


96 
91 
92 
93 
94 


95 


97 
98 
99 


18¢ 
161 
182 
183 
104 


165 
106 
107 
108 
189 


116 
111 


x 


67 
68 
69 


i) 
71 


T2 
14 


75 
76 
77 


79 


80 
81 
82 
83 
84 


85 
86 
87 


89 


98 
91 
92 
93 
94 


95 
96 
97 
98 
99 


100 
1201 
182 
183 
184 


105 
186 
167 
108 
189 


"118 
111 


112 
113 
114 


125 
116 


117 
118 
119 


128 
121 
122 


40 
41 


43 
44 


45 
46 
47 
48 


A=Té 


0045694 
0846946 
0047626 


0847626 
0846955 
0845651 
0843775 
0641469 


0838648 
0035597 
0032361 
0829042 
0825733 


0822517 
0819459 
#016611 
«814009 
0811674 


0009614 
0967826 
0026296 
0825009 
6393939 


0903064 
0892357 
0881793 
0801350 
0881005 


oB9OT41 
#868540 
9880390 
0098278 


0980197 


0000138 
999095 
0992066 
0900945 
e88O030 


020820 
0890213 
2820009 
0906996 
0080004 


088002 
0980001 


6000001 
0200001 


Az7B 


aS22001 
6800002 
e0B2003 
@O096005 
0899909 


#099016 
0086826 
0000044 
e9008G71 


A=71 


0943396 
0045311 
0046624 


0047290 
0247299 
0846633 
0045356 
9843517 


0241196 
0838486 


9835487 
0832302 


0829831 


0825765 
0822584 
0819555 
0216727 
0914139 


0011810 
0289750 
0087957 
0906426 
0005121 


0204040 
083152 
0022433 
0001857 
0081423 


0901048 
e@B2775 
0900568 
0000411 
0988295 


000209 
00147 
0299192 
0890971 
0830848 


0222233 
e800222 
0200014 
0800010 
0989086 


08S9004 
0228003 


aOO0002 
0880001 
0000801 


A=79 


0200001 
0280002 
0080003 


eBO6006 


0998919 
e280817 
0288829 
0988248 


A=72 


08407598 
0843147 
08459823 


0246309 
0946961 
0046961 
0046318 
3045066 


0943264 
0948987 


0038325 
0835377 
0032242 


0029818 
2O25794 
0922648 
0619647 
0216843 


0014265 
011942 
0229883 
e008086 
0966542 


0065233 
0084141 
0093241 
0882529 
@081922 


20001456 
2801692 
0060811 
0000596 
0200433 


00860312 
0880222 
02828157 
0960110 
oS2S276 


0202052 
0980035 
0206024 
0999016 
08822010 


oBS8807 
a2B2804 


020003 
0282882 


0282001 


0980801 


A=86 


0800201 
0902001 
a2O0882 


0980004 


e9DO0O7 
0882011 
0880219 
8889832 


TABLE 


Az73 


0837773 
0840551 
0942982 


0044749 
0046990 
0846639 
0846639 
e846089 


0844782 
0043814 


0842780 
0038166 
0935267 


0832181 
0829003 
0825820 
0822789 
0019735 


0816949 
0014387 
0@12072 
08108014 
0908214 


0226662 
0805344 
0804241 
@983329 
0802585 


0901986 
e801511 
0891137 
0200847 
0920624 


0900456 
0882329 
0080236 
2002167 
6280117 


6660282 
0000056 
2002038 
0803326 
0809017 


0888812 
oS60008 


0209205 
0222203 
0890002 


0200991 
08002991 
0092992 


A=61 


0008201 
0020881 
08822892 


0882904 
eB02207 
2000213 
2206622 


485 


1 


A=T4 


a834577 
o37628 
0848354 


0942669 
0844463 
0245698 
0946324 
0846324 


9045786 
08445983 


0842770 
e240576 
0838808 


0835158 
0832119 
0028986 
0025843 
0822766 


019828 
0817254 
0014586 
0012198 
0818142 


0998339 
0806781 
0005455 
6004349 
0993417 


0062661 
0982652 
0001565 
0201182 
e220883 


0086654 
0029479 
0820347 
0880250 
eS88178 


0208125 
0000087 
0800060 
0200041 
0680028 


#888819 
0020813 
099OG68 
6208005 
eDOODO4 


2220002 
0280061 


o800061 
oS89001 


0808801 
0880001 


eOD9903 
e8O0085 
0800088 
0999014 


A=75 


0031266 
0034484 
0237483 


0849169 
08042423 
0244191 
8945491 
0846015 


0246015 
08945489 


6944239 
0042529 
0848375 


0037852 
0835048 
08032056 
00928966 
0225863 


08228290 
0819991 
0017156 
0024622 
0012322 


0219268 
0898463 
0226899 
0025564 
0984439 


0883505 
0002738 
82117 
0861620 
0801227 


8900921 
0280684 
0888583 
o@00366 
0008264 


20000189 
0898133 
9206093 
0039865 
0088045 


e288036 
e600021 


028GG14 
0220009 
0082006 


0080004 
0280003 


6800002 
e2DOSOL 
¢9060001 


Ae83 


0800601 


0090GG2 
#280083 
0228805 
0208209 


A=76 


0827937 
931224 
0934391 


0837339 
#839969 
0842189 
6843923 
6045118 


0845712 
0045712 
0845118 
0043961 
0042292 


0948177 
eO37697 
0834939 
0031992 
6928945 


0025889 
0022871 
4919979 
o817255 
o814735 


0812442 
0818392 
6098584 
0807015 
2005672 


8004537 
#283592 
892814 
0082183 
0091676 


0801273 
0800958 
oOB8714 
98082527 
e888385 


0920279 
0000280 
2006142 
0289190 
08208079 


0880848 
0908233 


0880022 
2008015 
#200010 


0360267 
8800004 


0939003 
0899002 
8980001 


«220001 


A=84 


0888801 


0898051 
0208082 
8420084 
0028006 


As77 


6824675 
0627941 
0631168 


0834298 
6837197 
0839788 
9041959 
0043668 


0644825 
0845415 


0845415 
0944832 


0843697 


0842059 
0039982 
0837544 
6934830 
0831927 


0828922 
0825896 
9822919 
0920054 
08173590 


0D14844 
0012568 
0919513 
0068784 
08071306 


0895779 
0004635 
0903679 
6662891 
0062249 


0001731 
0801320 
08009996 
e8O0745 
#868552 


0990404 
0906294 
#006211 
0908151 
0220196 


0888875 
0808052 


0800036 
2800624 
0028016 


0800011 
0830007 


0900005 
899G203 
0093002 


0080001 
0298001 
6880801 


A=85 


0990001 


“0862081 


020002 
0200024 


x 


184 


165 
126 
187 
108 
109 


118 
111 
112 
113 
114 


115 
116 


117 
118 
119 


128 
121 
122 


40 
41 


43 


45 
46 
47 
48 


104 


105 
186 
167 
198 
109 


116 
111 
112 
113 
114 


115 


A=78 
0888113 


0898176 
03800270 
0828405 
#989596 
0988861 


0001221 
0981700 
0082326 
0883129 
0094136 


0085377 
0006875 
08808658 
0918709 
0813052 


0015662 
0016518 
0821549 
0024718 
0027942 


0831135 
0334205 
0337055 
0639593 
0841733 


0943482 
0044545 
0845123 
0845123 
0844552 


0843438 
#841829 
0839789 
0037392 
0034721 


0031862 
0828898 
0025908 
0022964 
0826126 


0917443 
0014951 
0012676 
0819631 
0088822 


0907243 
0805865 
2064732 
0003766 
0992968 


0882315 
0891788 
0801367 
0881835 
eB2O776 


0880577 
0880424 
#888309 
0808223 
0880163 


0808113 
©090080 
0600055 
0080038 
0886626 


0809018 


Ae79 
0096978 


0260123 
28621908 
0988289 
0080431 
0869630 


0600985 
0801276 
0001769 
0902410 
0803226 


0004248 
0295502 
0067019 
0088790 
0018851 


0013188 
015785 
0918612 
0821623 
0824757 


0827942 
0931088 
0934111 
0936914 
0839429 


0041518 
0943149 
2044270 
0944837 
0044837 


0844277 
0043183 
0041694 
0039599 
0837242 


0834613 
0831795 
0028872 
0025919 
0823807 


0828195 
0017532 
0815054 
0212788 
0818747 


0098937 
0807355 
0995990 
«004829 
0803853 


0083944 
0882381 
0081844 
0001414 
0001874 


0860808 
0982602 
0880445 
9868325 
0980236 


0082169 
0890121 
0800085 
02806059 
0880641 


0986628 


Azsd 
0882053 


e880085 
2820133 
0230284 
0800309 
0800457 


0880665 
2808955 
0280133 
0880183 
0888249 


0983324 
0894359 
0285625 
6967143 
0888929 


0010989 
0013326 
0815905 
2018711 
0021696 


0824793 
0927936 
09319490 
0634017 
0036075 


0839226 
0041291 
0842988 
0044898 
0844557 


0844557 
0044067 
2642933 
0641381 
0939411 


0837893 
0834505 
031729 
0628844 
825927 


0823946 
0828261 
0017618 
0215155 
0012898 


0812862 
0889851 
6207465 
0096094 
0094924 


0883939 
0893120 
0862447 
0901901 
0001462 


0881114 
0000841 
0860629 
0800466 
0868342 


0090249 
0888179 
0800128 
0882691 
0860064 


0809544 


TABLE 


Assi 
e200836 


0802258 
0968892 
0800143 
0860219 
8980329 


6090484 
0880781 
0002996 
0291390 
2231989 


0262577 
0083422 
28844728 
eO35747 
0087274 


0269864 
0611125 
6213449 
0016829 
0918806 


0821762 
0824827 
0227939 
0030991 
0033923 


0836636 
0839047 
0841975 
0842655 
0843735 


0944281 
0844281 
0843741 
0942687 
0043163 


0839226 
0036945 
0034397 
0931661 
0828815 


0825934 
0623084 
0820324 
e817781 
0015253 


0213805 
0819973 
0089163 
eOBT574% 
0986197 


0805219 
0284925 
0983197 
0982514 
0801958 


0081519 
0001154 
eBEO874 
0088655 
0088487 


0988359 
#880262 
0809189 
0800136 
0888096 


o800068 


486 


AzB2 
0882024 


28980839 
0800863 
0928108 
0829155 
0888235 


6026356 
0980512 
0886737 
0981042 
0081448 


0801979 
0082661 
0003519 
0804583 
0305868 


0907483 
0999198 
0811257 
013575 
0216132 


0216898 
021826 
0824857 
0827922 
8030940 


0033828 
0336499 
0838669 
0048862 
0B42414 


0643474 
0644811 
0044011 
0943481 
0842446 


0049947 
0039043 
0936799 
0034290 
0931593 


0828785 
0%25938 
023119 
0820384 
0817782 


0815349 
09131198 
0811683 
0809273 
0087681 


0886298 
0205114 
0904111 
0883273 
e082586 


0082015 
0881559 
0881195 
0800987 
0028682 


0000589 
0090376 
0898275 
0989260 
0080144 


0808182 


A=83 
6200216 


0888027 
o820043 
o820069 
0888108 
0882166 


0000251 
0290372 
0000541 
eSOO774 
0201089 


0001507 
00020598 
0802745 
0003616 
0294698 


0805988 
0007531 
0889329 
0811387 
0813697 


0016241 
0818986 
0821887 
0024885 
227912 


0938889 
0833734 
0236363 
0038694 
0040653 


0842177 
0843219 
0843746 
0843746 
0943225 


0942288 
0840735 
038863 
0036654 
0934183 


0831525 
0828753 
0225949 
0023151 
0828442 


09178698 
0915441 
0913213 
0811190 
0999382 


e2D7787 
0086399 
eBB5207 
0084196 
0203349 


0892647 
0882873 
831698 
0801236 
06086941 


e0O0718 
000531 
0800393 
0896289 
0999210 


0288152 


Amaa 
#000911 


0088918 
0888929 
0090047 
0088075 
0008117 


0090178 
0936267 
0890394 
e980571 
8982812 


6801137 
00281566 
0882122 
#982829 
0063713 


0864798 
0206107 
0807656 
0009458 
0011514 


#913817 
0016347 
0819671 
0821945 
6024918 


0027980 
0830836 
68336490 
0636227 
0838520 


6840446 
0041944 
0042967 
6043485 
0943485 


0842973 
6841974 
08648527 
0038685 
936511 


0234077 
0831456 
0028721 
0025941 
0623181 


0820497 
0917935 
0015531 
0813313 
0611296 


0009488 
0207891 
0866499 
€305308 
098428) 


6863425 
0862714 
0892130 
0661657 
0861277 


2980975 
8062738 
2900553 
0990411 
0888303 


6900221 


An85 
0880007 


0899012 
8828828 
0899032 
0806052 
0880081 


0908126 
¢6800191 
0800285 
0000417 
0060601 


0009651 
0001186 
0001626 
0882193 
0802913 


0893810 
0084986 
0866224 
0007783 
0009584 


0811638 
0813933 
0216449 
0219153 
0022800 


0024933 
0027886 
0930783 
0933546 
0836093 


0038349 
0840243 
0041715 
0842728 
0843229 


0043229 
6042726 
0041744 
0049321 
0838509 


0036369 
0033971 
0031387 
0028687 
0825948 


0823218 
08295598 
0018088 
0915619 
0613418 


0611399 
0089593 
0887994 
0006597 
0985392 


0094365 
0803500 
0202780 
0222188 
00817387 


6961319 
9001018 
0800766 
0990576 
0289438 


0800318 


183 
104 
165 
106 
107 


108 
199 


11¢ 
ili 
112 
113 
114 


115 


x 


116 
117 
118 
119 


128 
121 
122 
123 
124 


125 
126 
127 
128 
129 


130 
132 
132 


47 
49 


58 
51 
52 
53 
54 


55 


56 
57 


58 
59 


69 


62 
63 
64 


65 
66 


68 
69 


76 
71 
72 
73 
14 


75 
76 
77 
78 
79 


8o 
81 
82 
83 
84 


85 
86 
87 
88 
89 


90 
91 
92 
93 


Ax78 


0800912 
0099008 
2886905 
0889003 


2899002 
0890002 
0800901 
6608081 


A=86 


0890801 
0606081 
028003 
0860005 


0808008 


0800613 
0890922 


8289035 
0000856 


0998088 
0800135 
0800204 
0098302 
0000441 


0902632 
0880890 
0881235 
2321686 
0802265 


0802997 
0883906 
0025013 
0006342 
0887982 


0829709 
0811760 
0914946 
0816548 
0819231 


0822852 
0924954 
oO27870 
0030729 
0833451 


0235960 
0838189 
0848042 
06414990 
0842478 


0842977 
0842977 
0942483 
0841518 
0849118 


6938335 
0836229 
0033866 
0831317 


Au79 


#066019 
0000915 
0880009 
e8SOOS6 


0890004 
eS86002 
e800082 
#8908081 
#800001 


A=87 


0860881 
0880092 
0800003 


0890025 
0082089 
0890815 
9880024 
0288039 


0080061 
0000095 
0880145 
0098217 
0990321 


0900465 
e@83663 
0808930 
0801285 
0861747 


0062338 
0803082 
06864901 
0085120 
9866455 


0008823 
0099831 
0811679 
0814157 
0016644 


0819307 
0822101 
0824972 
2827853 
0930673 


0833357 
0035828 
0238913 
0239845 
0941268 


0842239 
0842730 
0942738 
0042245 
0841295 


0839919 
0838164 
0236090 
0033762 


An8O 


0889035 
0808021 
0886014 
0880219 


0200086 
2 O6O9G04 
s868803 
eB00882 
0660001 


0820002 


A=88 


o200001 
0088861 
09SS952 


0888083 


0080886 
0880818 


oPS0016 
0009626 


0900242 
0999066 
0086182 
0006155 
0908231 


00990340 
20884908 
0220695 
0880971 
02091335 


0001898 
0882418 
0903166 
0864097 
085225 


0896569 
0908141 
0829958 
0011995 
0814264 


0216737 
091938 
0822148 
0624987 
0827834 


6938618 
0®33264 
0835698 
0037848 
0839658 


0941050 
#042084 
0842487 
0242487 
8942919 


0241076 
0839722 
eB37995 
0235952 


TABLE 


A=81 


0880047 
0829033 
0888223 
028215 


09900198 
2809007 
0060205 
©080823 
©B00902 


0890001 
8008091 
eP20001 


0208001 
0898001 


eB29002 


eODO8B4 
e808006 


0060811 
0900918 


@880529 


0892946 
0BOOS72 


0060119 
0800166 


0020246 
282359 
0062515 
0960728 
0991812 


0901386 
0001869 
00982483 
0093250 
8284192 


6885330 
0996681 
«088258 
0012868 
0012109 


0814369 
0016827 
0819449 
0822192 
0825991 


0827814 
6230561 
6933170 
0035568 
0837685 


0839458 
0042835 
0841774 
0942248 
0042248 


6841779 
0249861 
0239528 
0237828 





I 


Az82 


0809972 
0880051 
#288835 
0808524 


0888017 
0898011 
#208008 
0803005 
@286003 


9288882 
0280001 
0290861 
eS88601 


A=9¢8 


02606001 


0926261 


6930882 
08860084 


0822307 
0988812 


0520620 


0880832 
0083950 


©908077 
0800118 


0820177 
0208261 
0889379 
0800541 
0000761 


0901054 
0001438 
0001931 
0002556 
0003334 


00804286 


#285433 
0006791 


0288373 
0010183 


012220 
0014471 
0@16914 
0019526 
0822234 


#825813 
e27792 
0939504 
0333077 
0935439 


0837524 
0039269 
0849623 


6041546 
0942813 


6242813 
0841552 
0940648 
6039337 





Aus3 


0886199 
o0O8O7T7 
e869054 
e898838 


©889526 
0980018 
0889012 
*360008 
©S99006 


0288804 
0f80602 
2806082 
eB06821 
0288601 


Az91 


0260861 
888902 
e268803 


0206005 
0989008 


0980813 


0800022 
0200034 


¢806654 
2690883 


0988126 
2909188 
0890277 
2298400 
0860568 


0820795 
0901097 
0901489 
001993 
0982629 


0903417 
0984389 
0805536 
0086901 
0998486 


0816297 
912329 
0814579 
#916999 
0819581 


0822273 
0925023 
e@27770 
0039446 
0032983 


0835312 
0837365 
0839883 


0248415 
8941323 


0241782 
0041782 
0841328 
0848439 


A=84 


609016 
0900115 
0800082 
9000058 


0890046 
0988028 
€900019 
#890913 
6690089 


6268006 
0 2OO004 
©802003 
©BOOD02 
6289001 


e888901 


Az92 


8080001 
6000001 
e89O282 
0986083 
¢300005 


0800009 


¢8088015 
6090624 


6890037 
0008058 


6888093 
0990135 
0999280 
2208293 
8000421 


900595 
6308830 
0001140 
9891542 
0862556 


e802002 
0893501 
0804473 
2605638 
©807889 


868598 


0816408 
0812435 


0614667 
0217881 


0819643 
#922319 
0025031 
0827746 
0838368 


0832896 


0835185 
0037297 


0838899 
0940219 


8641183 
0841555 
6041555 
2241166 


AwS5 


#980233 
6866169 
0990122 
0900887 


0800062 
0889243 
6000030 
998021 
6900014 


0006018 
s@BOO07 
0096004 
6900003 
0908002 


¢890991 
6996802 
#898001 


A=93 


2086001 
©000681 


68O80R2 
0809004 


0BS2006 
890019 
0800016 
890026 
6800041 


0808263 
09206096 
6800144 
€890213 
3898309 


0090442 
¢902623 
0000865 
0001283 
0601595 


0002118 
0622775 
0003584 
0004566 
0905739 


6867116 
0868707 
0819517 
0812539 
0814761 


0817168 
0019782 
0622345 
0825638 
0827728 


0230329 
0832798 
0835260 
o237052 
0838717 


0845008 


' 0840887 


0841331 
0841331 


116 
117 
118 
119 


120 
121 
122 
123 
124 


125 
126 
127 
128 
129 


136 
131 
132 


94 


95 
96 


98 
99 


168 
1061 
162 
183 
184 


125 
186 
187 
108 
189 


1148 
111 
112 
113 
114 


115 
116 
117 
118 
119 


120 
121 
122 
123 
124 


125 
126 
127 
128 
129 


130 
131 
132 
133 
134 


135 
136 
137 
138 
139 


140 
141 
142 


52 
53 
54 


55 
56 
57 
58 
59 


69 
61 
62 
64 


65 
66 


A=86 
0028652 


0825937 
0223236 
6629601 
0018078 
0015704 


0813586 
0811508 
0829696 
0988996 
0086694 


0025483 
0094449 
o8O3575 
0392847 
0882246 


0601756 
0001361 
0091045 
0999795 
0998682 


02OB449 
0099333 
0890244 
0939178 
0000129 


0888092 
e8O2D66 
0068846 
#002032 
0999822 


0696915 
©800011 
0986887 
©880805 
0898003 


#899082 
0990001 
0008001 
0999601 


A=94 


6990301 
0880001 
0896802 


0090004 
0089007 
0098012 
2988018 
0099028 


0928844 
0690968 
0862103 
0000154 
#890225 


0829326 
0009464 


A=87 
0931247 


0028616 
0825933 
0823269 
0029649 
0018146 


0015787 
0813599 
0811599 
0829797 
0808196 


0266791 
0865574 
0964532 
0003651 
0092914 


0802305 
2001886 
0001403 
0891980 
e280824 


0809624 
0080468 
0600348 
0808256 
2060187 


0038136 
0886098 
0300072 
0989249 
0830235 


0000024 
0800017 
0000011 
0250008 
0288885 


089993 
080082 
0808892 
0890801 
0000001 


A=95 


0800001 
#098001 


0300093 
eDSOOS4 
e890G07 
0980812 
0880819 


9800031 
0340048 
a268073 
0860112 
0008163 


0908239 
08603435 


A=88 
0933657 


e@31177 
#28579 
0925928 
0623282 
2826695 


0818212 
0215868 
0013696 
0811696 
0809897 


0938294 
0996886 
0825663 
6984614 
0283725 


0882988 
0002363 
0901856 
0201446 
0081116 


0030854 
0000648 
0060487 
0620363 
2060269 


0090197 
0200143 
0808183 
028074 
0882052 


0822937 
0808826 
0800018 
0008912 
0882808 


6805006 
0000004 
0090093 
0800002 
0029081 


3080061 


A=96 


¢200801 
6989901 


#9O8GG2 
2999003 
e802805 
0980008 
0860013 


#200021 
#980833 
0880051 
0802078 
0060117 


0880173 
0806252 


TABLE 


A=89 
0835816 


0033554 
0831107 
0928542 
0825928 
0823382 


0828739 
0@18275 
0015946 
0913778 
#811791 


0989994 
0868392 
006986 
0885752 
0064697 


0203860 
2OO3B47 
0062421 
0001927 
0001489 


0001152 
0000884 
29B0672 
2000537 
0288379 


0880281 
0283207 
0200151 
0280109 
0008878 


0800056 
#880039 
26888628 
#939619 
0260013 


0220209 
0002066 
e2O0004 
oP08203 
eSO0002 


2220001 


0800001 
0680001 


Au97 


0830991 


#822201 
0838082 
88028083 
02000085 
2089809 


0202014 
0800823 
oB00036 
02808055 
0882884 


0000125 
0002184 


488 


I 


A=98 
o@37663 


0835681 
0933451 
0831237 
9828503 
0825912 


0823321 
0020781 
0918336 
0816822 
0913865 


0911884 
0919098 
0068487 
e@27S73 
0895848 


904778 
0803874 
e003113 
6202479 
0801957 


0821532 
0601189 
0006914 
0009697 
0890527 


820396 
0808294 
0008217 
0060159 
0098115 


08090983 
0808059 
0200042 
0800830 
0008021 


0000814 
0208018 
6000007 
0500885 
0223883 


eDOOB02 


0202001 
e220081 
0980901 


0806991 
0288001 
eB88802 
8000084 
sB00886 


08000128 
0200016 
0000025 
0000939 
2268859 


0808296 
2808133 


And 
0839149 


68375098 
0835547 
0933348 
0830966 
0228464 


0225982 
0823338 
0020821 
2018395 
0816896 


013950 
0211976 
0018165 
0088582 
0887165 


0805927 
0284859 
€293948 
0883179 
0802538 


0682008 
0081575 
0061225 
0920945 
206723 


0900548 
0800412 
0888307 
0888227 
2988167 


0888122 
«269068 
0802863 
0900045 
0288032 


0998822 
0069015 
0000811 
20286007 
0060005 


2220883 
0288002 
0860801 
0959801 
2289081 


A=99 


0209801 
0000001 
0280002 
oBS084 


200007 
0890011 
0600817 
0286027 
0888842 


o280064 
0080096 


A=92 
0946233 


0838963 
837339 
0835415 
0033247 
6938896 


0828424 
0025891 
06023353 
0028859 
0018452 


016168 
0814932 
0012965 
919278 
0808675 


0207255 
¢996013 
8064948 
0604022 
2003245 


#882596 
0882859 
0091619 
2001262 
60006976 


6808748 
0692569 
0060429 
0002321 
0800238 


6080175 
2088128 
0000893 
6290067 
6080948 


0886034 
0002024 
0900016 
2800811 
6090008 


0020085 
aOB004 
0029802 
0893902 
0990061 


2999901 


A=160 


0889001 
o880081 
6020902 
0800003 


0028884 
8380097 
6800812 
93080919 
2888929 


98028045 
0080068 


As93 
0849892 


0848031 
eO38786 
0037181 
0835284 
0933145 


0230825 
0828384 
0925879 
0023367 
0920895 


0018587 
6916237 
0814113 
0012153 
0810369 


0908766 
aBB7345 
02806299 
0885019 
0384095 


00203311 
0002655 
09821190 
0001663 
00813006 


0981807 
eB807T4 
08005990 
0928446 
0000335 


0989249 
0898184 
0808135 
0890098 
oBO072 


0829950 
2808036 
0889025 
9800618 
6088012 


6990008 
oB00806 
0220004 
0889903 
0289002 


0960001 
6800001 
9009801 


A=101 


0800001 
8880002 
0820002 


0900803 
0889005 
9898008 
0006013 
0899820 


0898032 
0898048 


94 


95 
96 


98 
99 


160 
102 
182 
143 
104 


105 
166 
167 
108 
169 


116 
111 
112 
113 
114 


115 
116 
117 
118 
119 


126 
121 
122 
123 
124 


125 
126 
127 
128 
129 


130 
131 
132 
133 
134 


135 
136 
137 
138 
139 


140 
141 
142 


52 
53 
54 


55 
56 
57 
58 
59 


66 
61 


63 
64 


65 
66 


104 


105 
106 
107 
108 
109 


1196 
111 
112 
113 
114 


115 
116 
117 
118 
119 


120 
121 
122 
123 
124 


125 
126 


127 
128 
129 


130 
131 
132 
133 
134 


Aa94 


888652 
0996981 
0061227 


0021648 
00082181 
0092048 


0023667 
0684658 


0895838 
0007221 


06008816 
0019624 


0012641 


0014853 
0617237 
eB1l9769 
0822378 
0025042 


0827694 
0830270 
0832726 
0034935 
0936898 


0938538 
0239889 
0240674 
0041111 
0041111 


0046679 
6639831 
«838599 
«037924 


035154 


6833045 


30754 
0828342 
0825866 
823379 


0828929 
818560 
0016305 
0214192 
0012239 


0010458 
08068657 


08097433 
0826183 
0005999 


6204168 
0803377 


0902713 
0882161 
0001787 


0801337 
0291039 
0086891 
0900612 
0000464 


0889349 
0009260 


800193 
0800141 


00091203 


0200075 - 


09090853 
e880038 
0880027 
0880019 


A=95 


0000487 
o235680 
0802937 


o@91271 
0901761 
0002245 


802921 
0203750 


0934759 
0895937 


0887325 
0888922 


0810729 


0812749 
0814943 
0817311 
0619814 
0822489 


0825045 
0927666 
0936219 
0832614 
0034812 


0836746 
0238361 


0939612 
0040464 
0940895 


0049895 
0940469 
0339634 
0938421 
0236869 


0035025 
0632945 
0838694 
0028300 
0825851 


0023389 
0626962 
0018611 
0016371 
0014268 


0812323 
0810546 
0208946 
0027521 
0806267 


0965177 
0024246 
0063443 
eAS2772 
0982213 


00801752 
0801375 
0961071 
0889827 
0020634 


6986482 
2088363 


oB888272 
#200202 


0089248 


0888108 
0880079 
e000057 
0869949 
0880029 


A=96 


0890361 
2898519 
0888712 


6902973 
0991316 
0001755 


0082308 
#832994 


6983832 
0804841 
0826035 
0067428 


0899627 


0010832 
2012838 
215829 
0017384 
0219867 


0822438 
0O25047 
0227638 
0330151 
0932522 


0834698 
00936596 


0038187 
6839419 
0948258 


0042682 
0849682 
0943262 
6839448 
0838245 


0836715 
0934898 
0832845 
0032613 
2828258 


0225836 
0023399 
0020993 
0018661 
0216435 


014343 
#812495 
0818633 
0889833 
0007607 


0906356 
0885255 


0804312 
08063588 


0362833 


0602264 
e831796 
0981413 
0981103 
08280854 


0880656 
0882508 


@900378 
0908283 


0666211 


2860156 
0000114 
eSE0083 
00808068 
0®@B9543 


TABLE 


A=97 


9899266 
0080389 
0088534 


0200749 
0201911 
8291351 


2201889 
©002371 


0003267 
0803924 
0004931 
0966132 
0027529 


0889129 
0912933 
@012933 
0015114 
6917453 


0019917 
0022465 
0825047 
0227699 
02328998 


0032431 
6234569 
€636448 
0938015 
#839229 


0249954 
0940472 
0848472 
#240959 


2839249 


o238072 


0936564 
0834772 
0832746 
238542 


828215 
0925820 
0923406 
0621022 
0018728 


0016497 
0014416 
0812486 
00106718 
#209128 


6207692 
9006432 


0025333 
0094384 


eO23573 


0092888 
0882315 
0061841 
0881452 
0881136 


9080861 
0202678 


0900518 
0292393 


0998295 


0882220 
#002163 
6908126 
0200087 
0032063 


489 


I 


Ae98 


0800195 
0000281 
200399 


0000558 
oA20778 
0021048 


0001487 
0921863 


9282435 
0803142 
0993996 
0995821 
0026228 


0807630 
0009231 
#911932 
0013026 
0815197 


0017521 
0019966 
0822499 
a025846 
6027578 


0830830 
0932340 
0934449 
0036301 
0837846 


0039242 
0039854 
9040265 
0848265 
0939858 


0939861 


0637981 
0036415 
0034647 
0832648 


0936471 
0828172 
e825882 
0023413 
0821950 


6018754 
0016557 
0014488 
0012565 
0010801 


02O9264 
oOO7776 


00906513 
4925489 


0824455 


6803638 
0982947 
0902367 
0081886 
3081492 


00811668 
8008989 


oD88701 
0@98537 


0980408 


0820308 
0928236 
o808171 
0088126 
0923992 


Azg99 


0090141 
880206 
0888295 


0830418 
0889582 
0206801 
0001086 
9881453 


0221918 
0082499 
6063212 
0204077 


0805119 


9996323 
eBO7728 
0909331 
e%11129 
0013117 


0015277 
0017586 
0923012 
0222513 
0825843 


0927547 
0029969 
4832249 
0834339 
0836156 


0837678 
0938856 
8939657 
0848061 
0249061 


0039661 


0838875 
0837732 
0036267 
6034523 


0932550 
0939481 
0028128 
0825784 
0823418 


0821877 
0818798 
0016616 
0014557 
0012642 


0819883 
0289288 


0907859 
#896594 


0835486 


0084526 
0803703 
0003805 
0292418 
0881932 


0961529 
081202 


0898937 
e@O0724 


0808556 


0888423 
0860320 
0806249 
6089179 
0800132 


A=100 


#800192 
0800159 
0080217 


0600311 
€280437 
6630608 
0022832 
#001125 


0881499 
0281973 
0802562 
0283285 
2024158 


0095198 
0896417 
0987826 
0099429 
0011225 


0913205 
0015355 
0817649 
0628056 
0022535 


025839 
eO27515 
€929908 
832159 
0834212 


0036812 
0837513 
0238673 
#839462 
0039861 


2039861 


6939466 
0038692 
0037566 
0036121 


6934491 
0932453 
0030330 
028884 
o025765 


0823423 
0821181 
0218641 
0816673 
0014625 


0612718 
0018964 


0869371 
0807941 


0086673 


0095561 
3084596 
0883767 
0883063 
#832470 


e081976 
#891568 


0081235 
0000965 


eOO0748 


0926575 
2098439 
#898333 
0806252 
0800187 


Aeidl 


0292073 
0920109 
0968159 


@0989229 
0880326 
0880458 
0200633 
0800864 


0921163 
0081546 
@982628 
0992626 
0803357 


0884239 
0905285 
0896510 
#907922 
0999525 


6811318 
913292 
0915431 
0917711 
8020899 


0822555 
0825834 
0627483 
0029847 
0032869 


0834995 
0035871 
0037350 
0238493 
0939271 


0839663 


6039663 
0839275 
09386512 


0037401 


0035976 
0034279 
0032357 
#030260 
0828839 


0025745 
0823426 
0821125 
0716882 
0016728 


0814692 
0012792 


0811943 
0889452 


888822 


0886752 
0005636 
0204666 
0283831 
0983121 


#882521 
0882621 


0301607 
0991268 


#800993 


6809771 
0039595 
0868455 
0000346 
0030260 


x 


67 
68 
69 


a) 
71 


72 
1% 


75 
76 
TT 
78 
79 


J] 
81 
82 
83 
64 


85 
86 
87 
88 
89 


90 
91 
92 


94 


95 
96 


97 
98 


99 


108 
161 


103 
184 


165 
166 
1287 
108 
129 


110 
111 
112 
113 
114 


115 
116 


117 
116 


119 


120 
121 
122 
123 
124 


125 
126 


127 
128 


129 


138 
132 
132 
133 
134 





x 


135 
136 
137 
138 
139 


142 
141 
142 
143 
144 


145 
146 
147 
148 
149 


158 
151 


An94 


0898013 


"0880289 


0089886 
09B0G04 
e0SG903 


4080082 
0880001 
0098021 
00060001 


Ae102 


6020901 
2890081 


0080202 
0880003 
6828005 
0928089 
0800014 


00290022 
0980634 
08068052 
6800078 
0808115 


6092168 
0088241 
0090342 
0000478 
008659 


0999896 
0881203 
0001593 
0062983 
0282698 


0883439 
6084319 
0O@25372 
oSf6682 
0028017 


0829628 
00114128 
0013377 
0815505 
eO17772 


0820139 
e922574 
o@25027 
0027449 
0829765 


00931980 
0833979 
083573 
0837189 
e38316 


039082 
0939469 
0039469 
0239086 
0038334 


0837239 


Azo5 


0280020 
0800814 
0868019 
0209007 
0800005 


0999603 
eBSGOG2 
0280001 
0200801 
0260001 


An183 


0990001 


0000901 
0088002 
0208004 
209906 
0986810 


e099015 
0880924 
0996037 
0999056 
0200283 


¢980122 
0068178 
e282254 
099358 
6828499 


0800685 
0288929 
0801242 
0981649 
0862139 


0202754 
00935902 
02084398 
2005458 
0006693 


0208110 
e229713 
0811500 
0013460 
a@15577 


0817827 
0820178 
0022591 
0025028 
0027415 


0829724 
0931891 
0033864 
0935592 
4237930 


0838141 
0038896 
e239277 
0039277 
0238899 


038159 


A#96 


0290031 
e280022 


2802615 
0202011 
2000007 


0890005 
0882803 
0880802 
0982562 
6020801 


0802201 


Aw1f4 


0993001 
0080001 
e20G002 
0808004 
eBSS0O7 


0800811 
0600817 
#080626 
0083046 
ePDO066 


02998089 
0200138 
0082187 
009267 
0000375 


€282528 
2006712 
0882962 
0001282 
0001688 


6992194 
0662817 
eBO3573 
2004478 
0005544 


0006783 
a208282 
0089805 
0011588 
0013541 


0215647 
0817883 
0829215 
0222686 
0025011 


e927381 
0829662 
09318035 
0933750 
0835454 


0036873 
0037968 
0038712 
0039988 
239988 


0338716 


TABLE 


Az97 


0802045 
2200032 
6998823 
0800016 
0000811 


0300228 
0220885 
0202304 
e2O282 
0200002 


6209091 
602001 


A=105 


0208891 
#290061 
0989992 


eB2O223 
oDO2204 


eO20087 
0820812 
0822918 
0866028 
0000042 


2800064 
0252094 
#800137 
#800197 
0006288 


o220392 
908542 
0828739 
2092995 
0801322 


0991736 
#892250 
e982861 
0203645 
0004556 


0095628 
6926872 
2808293 
0299895 
0211674 


0813620 
e815715 
0017936 
0020251 
0822628 


0225081 
0827345 
0229680 
o831715 
0833637 


0935319 
0936718 
e@37797 
0838531 
0038992 


08389682 


1. 


A298 


o2SO067 
0098048 


eB08834 
0020024 
2000017 


0808812 
0820008 
eSO0086 
eB28864 
0060083 


e98S802 
08006081 
3022881 
oBB0G01 


A216 


0980001 
0020001 


0808862 
3020003 


e000205 
0008206 
0809013 
0688828 
0889930 


0000045 
0802068 
#090180 
0900145 
0000268 


0000294 
009684198 
0000564 
2000767 
0001029 


0881363 
e201 784 
0002386 
0282945 
0063716 


6904634 
e065712 
0096959 
0988383 
0099984 


e@11759 
6213697 
e815782 
0817988 
0820284 


8822633 
0824991 
0027309 
0329539 
0831627 


0933525 
0935185 
0236564 
8837629 
0938353 


0238718 


Az99 


©2SE097 
09BO07S 


08000851 
0888837 
0880626 


0280018 
282013 
0900889 
oS98806 
0626804 


6220503 
0988662 
0888001 
00288001 
0200801 


Aw187 


6800091 
0898002 
0009862 


0020883 
0238005 
0889809 
0888314 
0086621 


0200832 
0208049 
0000072 
09001086 
0986153 


2828219 
0809308 
0608428 
0088587 
0286795 


0931863 
0901464 
0881832 
002362 
0903008 


e803787 
0284712 
2985795 
o2B 7546 
0908471 


«816872 
0811842 
0013773 
0915847 
0918838 


0028317 
0922644 
0824979 
o827273 
029477 


0031549 
0833414 
0835852 
0836413 
0237463 


0838177 


Ae100 


280138 
09280162 


o898674 
0860354 
0686039 


0988028 
o800020 
0990014 
0888819 
0029837 


0802205 
¢060003 
2208092 
6822001 
6980001 


¢O08801 


A=108 


0886861 
o98081 


0020082 
0000004 
e860086 
0809869 
6060015 


8029923 
898935 
6900852 
e8QO077 
0000112 


6068162 
898230 
0282322 
0200446 
0000610 


0988823 
6801097 
€901445 
0801886 
€992418 


0093072 
6993858 
02994789 
eOO5877 
0087132 


6208559 
0810157 
0211924 
9813847 
6815989 


0218086 
0829347 
0222655 
0824966 
e027236 


0829415 
0031454 
6833304 
6834929 
0036264 


0373668 


Ael21 


880195 
0800145 


2606107 
0882078 
0888057 


0020041 
0098929 
08690821 
0829015 
08890108 


0880007 
0868005 
0888203 
06S8802 
0888902 


8820081 
2699001 


Aw#id9 


8066001 
0089002 


0808002 
0880002 
00BG804 
0899086 
0990010 


0880016 
02809825 
0600037 
989055 
6090882 


0000119 
6000178 
020H241 
6080337 
0900464 


0080633 
0609852 
0061132 
06091487 
0091929 


0802474 
0803135 
0893928 
0004866 
0865959 


e@O7217 
e2B86e4 
08192462 
0012994 
0813919 


0215971 
0818133 
#020376 
09226646 
0924953 


0827199 
0029353 
0031367 
0033195 
0834791 


0036116 


x 


135 
136 


137 
138 
139 


140 
141 
142 
143 
144 


145 
146 
147 
148 
149 


150 
3151 


x 


186 
167 
188 
189 


118 
111 


113 
114 


115 
116 
117 
118 
119 


128 
121 
122 
123 
124 


125 
126 
127 
128 
129 


130 
131 
132 
133 
134 


135 
136 
137 
138 
139 


148 
141 
142 
143 
144 


145 
146 
147 
148 
149 


150 
151 
152 
153 
154 


155 


157 
158 
159 


168 
161 


65 


67 
68 
69 


76 
71 


Aw192 


0035834 
0834159 
6932261 
0930190 


0827994 
0825724 
0023427 
0821147 
0818921 


0816782 
0814757 
0012865 
0811128 
0909532 


0698102 
0606830 
0985719 
0684735 
0093895 


0603178 
0892573 
0092066 
0801647 
0001362 


0801022 
0800795 
0900615 
0090471 
0892359 


0000272 
0000203 
e686151 
0888112 
0089082 


0000060 
0869943 
0098031 
0800922 
0f80016 


0000011 
2099008 
0862005 
eOB0004 
0099203 


0808602 
0909801 
0089981 
0990901 


42112 
oB2O0R1 


0800001 
0886902 
098003 
0800984 
2809987 


0080911 
020017 


Aa1@3 


0837879 
0835692 
0934949 
0832166 


0039119 
0927949 
0825783 
2823428 
821168 


0218959 
0016834 
0814820 
0812936 
0811197 


0009619 
0868181 
089969907 
0805784 
0004804 


0893959 
0893236 
0962624 
662112 
001686 


0061336 


0881250 
0086820 


0980635 
0000488 


0899372 


00006282 
0866212 
20021586 
0800127 


000606386 
0800863 
eSOGG46 
0998933 
0880024 


0890817 
0800012 
008008 
0305006 
0880804 


0826003 
e2OS2H2 
880081 
0890001 
¢806991 


4=111 


08990091 
0980001 
9899082 
0880903 
889525 


0299998 
0980012 


A=184 


0237985 
00369208 
0935553 
0833922 


0032072 
0232949 
0827983 
0925681 
0823428 


0021187 
0818995 
0216885 
0614881 
0013806 


011271 
0309688 
0888259 
2886983 
0095857 


0824873 
0884022 
0003293 
o®02676 
062157 


0981726 
0801370 
0861386 
0000844 
0008655 


0808505 
0009386 
0880293 
0988221 
0O22165 


0008123 
00900091 
o998G66 
0000048 
0800035 


0880025 
0900018 
0060013 
e600009 
0839986 


0800004 
029603 
0088082 
0060001 
0969601 


0880901 


A=112 


0909001 
28060981 
#862002 
08886093 


0982005 
2000008 





TABLE 


A195 


0838535 
0637815 
0036764 
o@35415 


0833895 
0831978 
0829979 
0827857 
0225658 


0823427 
0021285 
26190832 
0816934 
6914941 


oB13074 
0811345 
2009764 
0908335 
0807058 


0025929 
6204942 
0984085 
0883351 
0882727 


0882293 


0921766 
0981405 


0081189 
«982869 


2802676 
0800522 
0090409 
©OB0304 
0802232 


0880172 
280128 
2808095 
0880072 
0080051 


0020037 
6800026 
0086019 
6902013 
2880029 


eBB22B7 
eO22005 
e0008B3 
#22OBG2 
0800001 


0983801 
0058052 


A=113 


#000801 
@0O8001 
4883982 


0880024 
0800206 





491 


I 


A=106 


0838718 
0838356 
6037646 
0936619 


0935279 
0833699 
0831895 
0829918 
e827811 


0825634 
0823424 
0821222 
0819864 
e816981 


0015980 
0013141 
0911417 
0929839 
0988411 


0967132 
0826808 
2825008 
0884147 
0883498 


e882779 
0822248 
0991806 
0881439 
0991138 


0088894 
#820697 
2008539 
0908414 
0880316 


0888239 
2000180 
0800134 
2829899 
0288873 


0880854 
#080039 
0030028 
0288026 
08 O2014 


008608128 
D9SO87 
0080005 
0880003 
0888802 


0828802 
e22S001 
08282001 


A=114 


0000081 
0288601 
#888862 


9828062 
00S8604 


A2107 


0938537 
0038537 
0938189 
09374898 


0936458 
0835144 
0933575 
0831792 
0929840 


o827764 
0925619 
0823421 
0821238 
6919696 


0017627 
eBi5057 
0613286 
e811488 
0289913 


0008486 
28897206 
08906071 
0865075 
0984210 


0993465 
0802832 
0082294 
0891846 
0881474 


0001168 
0909919 
©808718 
0009557 
0980428 


0886327 
0080248 
0989187 
2909149 
0800104 


28900877 
0860056 
e0860041 
2889930 
0903021 


0899915 
oS80011 
0288008 
0909085 
00S0004 


2930093 
eBOOGS2 
2088001 
0088001 
980001 


Aw115 


0809601 
e88G001 


0889982 
2000003 


A=z108 


6938903 
0038359 
0038359 
eS38007 


0937316 
0036387 
0035819 
0633461 
0931700 


e829771 
eO27717 
0825585 
0823417 
€921253 


#919127 
0817972 
#815213 
6013276 
6011558 


0899986 
#898559 


6607279 
6806142 
6865142 


0884272 
6803522 
802881 
0062340 
6801886 


0882589 
0901198 
0600944 
¢609739 
008574 


6820443 
0880339 
€999258 
0886195 
8800146 


2208109 
600081 
2008959 
0090643 
0380031 


288023 
6000616 
9080011 
8930088 
0833806 
0082054 
8808803 
#020882 
0800001 
69006081 


0999901 


A#116 


6092001 


08006901 
0O@02082 


A=189 


eG37138 
0237832 
0838183 
0836183 


0837835 
0837154 
#636159 
e@348T9 
0033349 


0831629 
0829761 
0827671 
08255693 
0823412 


0821266 
0019157 
0817116 
0815168 
0913333 


0911626 
0810058 
0988632 
6067351 
0606211 


0805208 
0094333 
0903578 
0892932 
0992385 


0821926 
0001544 
0961228 
88966972 
0988762 


8680592 
0809458 
800351 
©806268 
0880203 


0600152 
6800114 
0390084 
808062 
0890845 


0888033 
*898024 
0020017 
2029012 
6880009 


0889806 
2890024 
2820003 
©020082 
690O001 


0989901 
9808001 


Az117 


0009061 
0088021 


x 


166 
107 
198 
163 


118 
111 


213 
114 


115 
116 
117 
118 
119 


120 
121 
122 
123 
124 


125 
126 
127 
128 
129 


136 
131 
132 
133 
134 


2135 
136 
137 
138 
139 


148 
141 
142 
143 
144 


145 
146 
147 
148 
149 


156 
15% 
152 
153 
154 


155 


157 
158 
159 


1606 
161 


6% 


65 
66 


68 
69 


78 
71 


x 


72 
73 
74 


75 
76 
77 
78 
79 


8a 
81 
82 
83 
84 


65 
86 
87 
88 
89 


90 
91 


93 
94 


95 
96 
97 
98 
99 


102 
101 
162 
103 
184 


185 
106 
167 
168 
109 


119 
111 
112 
113 
114 


115 
116 
117 
118 
119 


126 
121 
122 
123 
124 


125 
126 
127 
128 
129 


1308 
131 
132 
133 
134 


135 
136 
137 
138 
139 


Aw110 


0800226 
0089040 
0888859 


«000687 
0006125 
0020179 
0988252 
0090352 


0990483 
a030656 
0006881 
e001167 
0981528 


0801978 
0002532 
0893199 
#263998 
6084942 


0206249 
o@D7301 
#998729 
0019325 
0912882 


0813998 
09160308 
#018178 
6920404 
0822671 


0024939 
0627161 
0629291 
0031282 
9033086 


0334662 
0635970 
0036979 
0637663 
0638929 


0038809 
0037666 
0036994 
0036012 
0234748 


0033237 
0831518 
00929632 
0827623 
0825534 


0823496 
0821279 
0019186 
e017158 
0815221 


0913394 
0811693 
0912128 
6998704 
0027422 


0986280 
0085273 
0834394 
0093634 
0002984 


0882431 
0901966 
0221579 
0281258 
0863996 





A=111 


#890019 
#200028 
0860042 


2909863 
#268992 
0800132 
0068188 
0288264 


0088367 
02882583 
0890680 
08069190 
#601202 


0081570 
0202027 
0982586 
0263262 
0804068 


0905217 
0086122 
0287383 
0808813 
0810486 


0812159 
0014859 
0816088 
#918222 
082043) 


0022678 
0824923 
0827123 
0829229 
0831197 


0832979 
0934535 
0035826 
003682) 
0037497 


0037838 
0837838 
0037500 
0036836 
0035867 


0034619 
0033127 
0831428 
0029564 
027576 


0025588 
08234890 
0921299 
019213 
0017199 


0015272 
0213454 
0211759 
0013197 
e008775 


0887492 
0086348 
0005338 
0004655 
0003691 


0883034 
0262477 
00820287 
9001614 
0281289 


A=112 


6899013 
0289920 
2999939 


0900045 
oB32867 
e200897 
0089139 
0089198 


0660277 
0206382 
9802522 
#0705 
0289948 


«061238 
0901612 
0982576 
0802642 
0083325 


0804137 
0835892 
0226199 
0837465 
0808895 


2010486 
0812234 
014126 
0916144 
8018264 


0020456 
0022684 
08924908 
0827884 
eO29167 


0231112 
0932873 
0834499 
0935683 
0836665 


0037332 
0237668 
0837668 
0937335 


0836680 


0835723 
0234491 
0033017 
0231339 
0229495 


2827529 
0025481 
0023393 
0921301 
0@19239 


0817238 
0815323 
0013513 
0911824 
0019266 


0288844 
0887562 
0886416 
0005403 
2004516 


0003746 
0863685 
0262522 
0602047 
0201649 


TABLE 


A=113 


62928209 
0830014 
0f89822 


0222932 
6800048 
0882271 
0992193 
0880147 


0908287 
8832289 
#800398 
0899542 
0280729 


0802970 
0081274 
0021655 
0862125 
9202698 


0963387 
2004286 
0995166 
0886277 
0207546 


0®@98976 
0810565 
0912308 
0814192 
0816199 


0218305 
0820489 
0822688 
0024891 
0927845 


08291085 
#831028 
0032767 
0234284 
0035543 


#036512 
0837170 
0937592 
0837582 
eB37173 


0836526 
6935582 
0034365 
02329089 
0231250 


0829427 
0027481 
0225454 
0923384 
0921318 


98019264 
0G17277 
0215302 
0813571 
0911888 


0219333 
0068913 
eO27638 
0206483 
0205467 


6994576 
0033892 
0083136 


0902568 
0202088 


1 


Azll4 


0822006 
0809019 
0828915 


0888023 
0000035 
0800051 
e88S975 
0983108 


0900154 
0898217 
#999382 
0000414 
0880562 


0900754 
0091800 
0281310 
0801697 
e82174 


e292754 
0083450 
0284275 
0985249 
0006355 


0237626 
08909956 
0010643 
0812380 
0814256 


@816252 
e218344 
0828582 
0822692 
0824804 


0627586 
8829944 
0830944 
0832663 
0034161 


0835493 
0836369 
0037019 
0037337 
0037337 


0837012 
0936374 
0835442 
0934240 
0328061 


0031162 
0829359 
0827434 
0925426 
0223376 


0621319 
0019288 
o@17314 
0015429 
0013627 


0211959 
0818399 
0088981 
0007698 
0936549 


0005530 
064636 
0023857 
0893187 
6882613 


A=115 


eDOSO4 
0900807 
0906611 


0209016 
08089025 
0032037 
0200055 
898879 


0800114 
#892162 
0906227 
0990315 
0860431 


0998583 
6880786 
0801038 
0201347 
0801748 


0202223 
02628108 
0893512 
0284343 
0065313 


9806432 
0897785 
6899134 
016719 
0812451 


0214319 
0216304 
0018382 
0828523 
0822694 


0224856 
0826966 
0028982 
e238860 
0832559 


0834039 
0835266 
0836216 
0836851 
0837175 


0837175 
0236854 
0036224 
035303 
0934117 


0932695 
0831874 
0829291 
0027386 
0925398 


0623366 
021326 
0019311 
0817358 
0215467 


0013682 
2012811 
0810464 
0229848 
eO07765 


0906615 
005593 
0204695 
0893913 
0263237 


A=116 


6260903 
6869095 
0283007 


#888612 
0002018 
200026 
0808939 
0808058 


8 B20084 
8090128 
0820172 
6980238 
€800328 


6890448 
€282694 
0890805 
0001962 
0001383 


0881783 
0802273 
00092666 
aOO357% 
0904411 


0995386 
0896588 
0807783 
0689212 
0018794 


0212521 
6014389 
0016354 
0818418 
0020544 


0922696 
0024837 
2626926 
0828928 
0830778 


0932456 
2833918 
0835130 
8236862 
0036695 


0837814 
eO37014 
¢936698 
0336976 
0935166 


8033994 
0632589 
0830987 
0829223 
0827338 


a925370 
0823356 
0921333 
0219333 
e917T385 


0615513 
0013736 
0812071 
0010528 
0909114 


6007831 
0006686 
0065656 
eBO4754 
6003967 


Az1i7 


0988002 
0808003 
0820085 


0089008 
0883012 
288019 


. 6888328 


0082042 


0290961 
0660089 
0990126 
6009178 
0880248 


0980342 
0090465 
0890625 
0090831 
0091892 


0801428 
#001826 
0862322 
0992921 
0003636 


0804478 
0925458 
0896583 
0007859 
0829288 


0910867 
08125869 
00146442 
0816463 
0818454 


0020562 
0822696 
0624818 
0226886 
0828859 


0830695 
0832355 
0833799 
0934995 
¢035916 


0836541 
0636856 
@836856 
0936544 
0935929 


0835631 
0633873 
0832485 
0830908 
0929156 


0827299 
0025341 
0823345 
0021339 
0819354 


0017419 
0015557 
0013789 
0012130 
0919591 


6089179 
e@O7B97 
0806744 


0895718 
00804813 


123 
104 


105 
106 
187 
108 
199 


110 
112 
112 
113 
114 


115 
116 
117 
118 
119 


126 
121 
122 
123 
124 


125 
126 
127 
128 
129 


132 
131 
132 
133 
134 


135 
136 
137 
138 
139 


x A=110 


146 0390782 
141 98006120 
142 0090473 
143 08003646 
144 00809278 


145 6800211. 


146 0890159 
147 2808119 
148 0880288 
149 «020065 


158 9SD6048 
151 0990935 
152 0099925 


153 oBP0018 
154 808013 


155 822029 
156 0826006 
157 oB20095 
158 0896803 
159 6890802 


16a 0000021 
161 ©039901 
162 0888001 


x A=118 


78 0929001 
71 0800001 
72 oBO20E1 
73 0820022 
74 0BBB004 


75 2088006 
76 eBO0089 
77 #888013 
78 0898028 
79 6909830 


82 0999045 
81 e000065 
82 0899093 
83 9892133 
84 0683187 


B5 0888259 
86 0800355 
87 0000482 
88 0680646 
89 0000857 


96 0881124 
91 0001457 
92 #001869 
93 0@02372 


94 «802977 


95 0883698 
96 0004545 
97 0005529 
98 0006658 
99 0887935 


106 0009364 


122 0910949 
182 0812656 


206-687 O - 77 - 32 


Aelll 


0891022 
0260824 
0020629 
0680488 
oO980376 


09906288 
0289219 
e200165 
6990124 
0000892 


0900068 
00990958 
0809037 


0806827 
2000019 


0860014 
0080815 
62BO297 
0930095 
0998803 


#888082 
0808822 
e8O0801 
0888001 
0890881 


A=119 


0800081 
9828001 
0880082 
e202 


4099204 
20008686 
aBB@0B9 
0908314 
e260022 


0998032 
eSB0047 
e200069 
0930898 
#883139 


0280195 
0080276 
00980372 
0800502 
0990668 


0080884 
0201155 
0001495 
0001912 
0282421 


0293933 
0903759 
0064612 
0905600 
9006731 


0808910 
0989438 
0811011 


Azll2 


08913293 
0881848 
0889827 
0208647 
0960504 


0820389 
0880298 
0898227 
0800172 
0960129 


0800097 
0098672 
0080053 


999539 
0080628 


0200020 
0260915 
0998910 
0200007 
0822005 


0890004 
eO80003 
0880062 
9820001 
0800001 


0280001 


A=12¢ 


2200001 


0088801 
#802052 


@806903 
26O0984 
e88007 
8889010 
0060015 


0888023 
0009034 
0009050 
0800073 
0098194 


0080146 
0838204 
e262282 
o820384 
0880518 


0289690 
6669910 
0061187 
0881532 


0091956 


6082478 
0603088 
0093826 
0904678 
«205670 


0086804 
0008084 
0069511 


TABLE 


A=113 


0091685 
0201352 
0921875 
0002849 
0920666 


0800519 
#000492 
08829399 
0082236 
0980179 


0800135 
09801081 
2002075 


6@00655 
6206841 


0030030 
0099921 
@200815 
0800011 
0060008 


#200896 
0802904 
0990993 
0822262 
e222901 


2900091 
0680001 


Ae121 


0806901 
9822001 


0992002 
0228693 
0808085 
#988007 
0080011 


0080017 
0899925 
0290036 
9202853 
0280877 


3962129 
0200153 
0022213 
9282293 
9938399 


¢962536 
0298713 
0290937 
#981219 
0801570 


0291999 
0082520 
6903143 
o003881 
084744 


0285749 
3206876 
0998157 


493 


1 


Anll4 


0882128 
881721 
08061381 
0801181 
o823872 


0280685 
0980535 
0288415 
0880320 
eBOS245 


00686186 
0800148 
0900185 


0290978 
#206058 


0800043 
0800031 
008023 
0000016 
o@O0012 


0800688 
©DBO0B6 
0900004 
28290683 
0223882 


0990861 
2608001 
0888082 


A=122 


0889901 


2909001 
6808082 
2396663 
0829865 
00890268 


0966812 
0298218 
0809826 
0808839 
0800856 


0099081 
0608114 
0800161 
0888223 
0899305 


0830414 
0900554 
0808735 
0008964 


0891252 


0001608 
0002043 
0002569 
#203199 
0883942 


0984889 
0885869 
0026948 


A=115 


0292659 
0092169 
0001756 
0281412 
0991128 


0000895 
0206705 
0880551 
0839428 
0980331 


0986253 
0888193 
0990146 


#260119 
802082 


0900061 
0008045 
2098033 
#268024 
0000817 


#806812 
e2OG0B9 
2996096 
e 20084 
e20SO03 


0000982 
sO000001 
o0S0801 
e2O8051 


A=123 


0828081 


0800S 
eOSGO01L 
e2OSO82 
0930053 
0299888 


0008208 
829013 
0993619 
0800028 
0B00041 


2208059 
0200685 
0968120 
0086168 
0090232 


0906317 
098G429 
eP8G573 
0002758 


998992 


0901284 
0001645 
0882687 
0802619 
e8G3254 


0084002 
0804874 
0885877 


A=116 


6803287 
8882705 
8882209 
081792 
0801444 


00061155 
#008918 
0029724 
0098568 
0899442 


0895342 
0038262 
0000200 


6060152 
0920114 


0029086 
0989064 
0000047 
0082035 
¢O00825 


2800018 
0920813 
0892089 
2008807 
oB00085 


0960083 
02990082 
0888382 
6800001 
0200001 


09900681 


Awi24 


6800001 
e800081 
e@O08B2 
0880852 
0829004 


2880006 
#888869 
6803014 
#828828 
9820039 


©O00043 
0080063 
2280089 
60066126 
0090176 


8893242 
0839330 
0900444 
0080592 
aG00781 


#001928 
0981317 
0801684 
0862130 
00092668 


80033509 
0004062 
8894938 


Ael17 


6884922 
6993338 
0902758 
0002250 
0941828 


0801475 
00801182 
0820942 
0900744 
0886584 


0880456 
0000353 
0006272 
0999298 
0000158 


0090119 
0909989 
0800067 
6000049 
0890036 


8800027 
0800619 
0006014 
0800018 
280007 


09OO095 
oOP0084 
6888502 
689G02 
06000601 


8980001 
oO69201 


Ae125 


890001 
880001 
0888002 
0288803 


8280004 
0809006 
0830910 
0802014 
0280022 


0200032 
2900046 
0860066 
0880594 
0980132 


¢006183 
e8@8O252 
0809342 
0820469 
0060611 


0290825 
0881948 
0001350 
0981722 
6862174 


0082718 


0883363 
0604122 


x 


149 
141 
142 
143 
144 


145 
146 
147 
148 
149 


158 
151 
152 


153 
154 


155 
156 
157 
158 
159 


180 
161 
162 
163 
164 


165 
166 
167 
168 
169 





x 


163 
184 


105 
186 
107 
168 
19 


116 
111 
112 
113 
114 


115 
116 
117 
118 
119 


128 
121 
122 
123 
124 


125 
126 
127 
128 
129 


132 
131 
132 
133 
134 


135 
136 
137 
138 
139 


1428 
141 
142 
143 
144 


145 
146 
147 
148 
149 


156 
151 
152 
153 
154 


155 
156 
157 
158 
159 


160 
161 
162 
163 
164 


165 
166 
167 
168 
169 


176 


A=118 


0014499 
0816451 


6918487 
0020580 
0022696 
ef24798 
0226845 


0828797 
0339614 
0032254 
€033681 
0934862 


eO935772 
0836389 
0036708 
e836 700 
0036391 


e@35785 
0834898 
0233753 
0932381 
0030814 


0829989 
0827242 
0025311 
0823334 
0821344 


0919374 
0017451 
0215600 
0013841 
0812188 


0010654 
0809243 
0227962 
096898 
0085779 


0804871 
0884076 
0803387 
0202795 
0002291 


00861864 
0001597 
0061289 
00900964 
0082764 


0020601 
0980469 
0880364 
0898281 
0888215 


0880164 
0889124 
0888293 
0090070 
0899952 


«900038 
‘0098028 
0088528 
0800015 
0800011 


0000008 
«990005 
2080004 
0080003 
2800202 


eB60001 


A=119 


0012721 
0814556 


0816497 
0018520 
0826597 
0922695 
eB24777 


0026804 
0028736 
0030532 
0932153 
0033564 


0834731 
0835629 
0®36238 
0836545 
0036545 


0836241 
0835642 
0234765 
0033635 
0232279 


0838729 
0829022 
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2900017 
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0B80002 
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eZD2B89 
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©B80227 
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0009352 


0BBD454 
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0903117 


663718 
494491 
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2990162 
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«296080 


eOB7G35 
ePS8G335 
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690155 
0800122 


©906095 
8BOOBT4S 
#@9BB957 
8BOG044 
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8099785 
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6893239 
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8809908 
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211 
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4219223 
eBG8994 
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0260837 
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001425 
2@61181 
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800428 
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0810999 
0298983 
o2B7947 
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2QB2967 
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0028527 
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@231328 
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e931136 
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0230197 
0229469 
2928587 
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0826424 
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0923855 
0922468 
0221046 
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0016691 
0915277 
2813983 
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0889822 
eO27987 
#687932 
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6924646 
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0293432 


002926 
@832482 
0202094 
001758 
0261468 
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050829 
0800678 
0900552 


eBDD447 
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eD23567 
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0827408 
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0029356 
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0938659 
0231945 
0$31232 
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0931941 
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e936111 
0829399 


0928515 
0827582 


#026379 
#025136 
09235821 
eD22444 
#921625 


0819583 
018137 
#016782 
0015295 
0813928 


0012612 
#611358 
#619172 
#229661 
6248927 


097072 
#206198 
4205452 
0fD4684 
0984839 


©2G3465 
0862957 
0992511 
0062120 
0291782 


0901489 
#601238 
#201925 
DOO844 
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0929457 
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026296 
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022149 
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8910529 
#011827 
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0216892 
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929618 
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6924993 
0226189 
0O27347 
0828385 


6929278 


0D39B19 
#930569 
839946 
0031136 
0931136 


0930948 
6939575 
6939826 


0929311 
0828443 


8227446 
8926316 
0925992 


8623787 
6922426 


021811 
8919578 
0018149 
6816713 
0915313 


0913952 
0912641 
8911391 
8019268 
8999299 


@SS8266 
#907112 
6806237 
8995441 
0204721 


@BO4875 
6993499 
0082989 
0992549 
06902147 
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#991511 
6091258 
4991942 
0B50859 


eD2O704 
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0269466 
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6200383 


6396242 
®89D193 
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0999129 
0690095 


9B0OB74 


Anl63 
8098218 


0999352 
0G16569 
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6914646 


#16119 
0917604 
«619110 
0820609 
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e223585 
#924863 
626128 
0227286 


928315 


6829209 
0829926 
6$30498 
9D3G854 
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0930855 
8939485 
0929941 
0929232 
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eD27377 
8D26263 
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#923753 


0922398 
0320996 
6219572 
#218143 
016724 
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0G13975 
8012678 
0911424 
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€904758 
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0003533 
8993828 
0292569 
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#991839 
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aDOBB7T4 
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#920586 
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262 
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216 

















x 


211 
212 
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112 
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#061899 
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eOD2767 
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0390001 
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0005145 
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8G12068 
2D1349Q 
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0001400 
0001728 
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#DDOOG3 
oF996G1 
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0999945 
0999401 
0996738 
0988845 


©966729 
0924959 
0856735 
0761221 
0644217 


0516812 
391955 
02886719 
189876 
0121395 


0073458 
0942139 
0822956 
0911898 
eP2S5877 


efG2772 
#291254 
0006549 
0DDG224 
208089 


09BOG34 
0020013 
@BDOGG4 
©DDGHSG2 
0469681 


A=1606 


1eFAGGHG 


0999975 
0999711 
2998311 
0993365 


2989259 
0952473 
0993384 
829856 
0736557 


A=9el 


0948318 
8899249 
0892177 
8687684 
0557448 


8425765 
0395933 
6206889 
0131624 
aB798G1 


08644795 
aA24944 
912242 
#6065924 
60062731 


0661261 
0260595 
#6992903 
6999078 
884029 


0999010 
0DDBGO4 
6DBG6001 


A=909 


10406900 
0999959 
0999453 
8996994 
988889 


8968798 
6929935 
6863426 
6776636 
6655889 


8529498 
0404451 
#291999 
6199862 
0128355 


6878355 
0845355 
6924936 
0613045 
@896595 


6883098 
eOG1411 
0GO616 
0966258 
aAOOINSL 


8BOBD4B 
8$G0015 
eDAAAGS 
8DDGAR2 
0FOGOO1 
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18960066 
8999977 
0999736 
0998446 
6993843 


¢981529 
6955179 
0968187 
0836358 
6748285 


A=902 


0951429 
8895926 
0818835 
2699899 
0570391 


8436924 
e317974 
0216815 
0139261 
@G84376 


8848389 
0926188 
0813468 
0086584 
#933066 


0901362 
8208579 
#29235 
6890692 
089OB34 


0090012 
eBDAOR4 
8905001 


A=10 08 


10968986 
8999955 
0999591 
0997231 
0989664 


0976747 
0932914 
0869859 
779779 
0667180 


0542676 
6416963 
0383224 
0208444 
0135536 


0983458 
0248749 
6827842 
0814278 
e9D7187 


0993454 
6891588 
0800780 
€990296 
6998120 


8DBDA4ST 
0498018 
49D9906 
8BBBBH2 
0BBO61 


A=1908 


16880000 
699998¢4 
0999759 
6998578 
8994287 


0982723 
0957745 
0912784 
0843417 
e749771 
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A=16el 


0554517 
#429469 
0314652 
0218915 
0142935 


oB88776 
052300 
0829277 
0915599 
oAB7925 


0903845 
0GG61784 
2B9D794 
2060339 
*O6H1359 


«022055 
oDDDD24 
©DDODO8 
«443963 
© 9DODG1 


A=109 


1e930400 
999982 
0999786 
«998684 
2994788 


0983843 
0968177 
2917182 
4859233 
0759914 


0648539 
0528121 
0498797 
0382412 
«289535 


013878 
of87366 
2052339 
«029881 
0916282 


0DD848H 
°$94228 
#62021 
oFBB927 
2DDG409 


©96174 
oDOGB71 
#490S28 
«99011 
°9BOBS4 


©SO9001 


A=1167 


10999000 
0999992 
0999895 
0999327 
0997113 


0996637 
2975484 
2945936 


A=1G 02 


0566829 
0447966 
#326183 
0227768 
0159550 
0494292 
0056036 
#431647 
s017015 
0468723 


e9D4271 
39S2001 
2900898 
0006387 
oSOS168 


©2BO064 
0B9O6G24 
eBASOB9 
#99OG3 
22OOO1 


A=T1 eH 


1eBSSHGA 
0999983 
0999808 
0998789 
2995884 


0984895 
0962485 
0921386 
0856848 
0768915 


0659889 
e54G6111 
0420733 
0311393 
0218799 


0145956 
0992604 
ef55924 
0832191 
017687 


2969289 
0964671 
0662252 
091942 
000464 


o28G199 
089982 
2948G33 
©909G13 
026OGG5 


©99G002 
©BGG001 


A=Tie8 


10890000 
0999992 
0999984 
2999381 
0997326 


0991264 
0976957 
2948619 


A=1603 


0578997 
0454438 
0337805 
0237695 
0158378 


01469422 
0059952 
0634156 
0@18527 
0SG9584 


0064736 
6292239 
#DD1814 
0900441 
0960184 


eDGOD74 
0269629 
e9GAA12 
0BAGAG4 
#906061 


A=llel 


1084045 
0999985 
0999817 
#998886 
099544) 


0985882 


2964661 


0925493 
0863159 
0776773 


0670243 
0551993 
0432669 
0322294 
a228951 


0153339 
oS98036 
0659676 
0834629 
0919184 


0919164 
0965152 
0862505 
«8011706 
eBGH525 


#600227 
eBBHA94 
099GG38 
«OS9015 
©FBO4G5 


©BOO4GH2 
©DO5OO1 


A=1109 


10890406 
0999993 
2999912 
0999432 
0997524 


0991851 
0978347 
2951565 
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0591013 
0466874 
0349566 
0247787 
0166413 


0145963 
0G64951 
0636898 
0020142 
0419512 


@DD5242 
eA625G1 
eOAL14S 
2DOGB502 
0260212 


eODDO86 
@9B0034 
0988913 
eBABGAS 
*BBODG2 


eGOOG01 


A=1102 


1 eABAGOH 
2999986 
0999833 
«998976 
0995774 


0986888 
#966726 
#929239 
«869261 
0785296 


e68B794 
0563758 
0444595 
6333375 
0237555 


#169899 
0193663 
2863597 
o937201 
eA20T77 


ef11995 
2965673 
0902782 
6961310 
©9DH593 


#96B258 
eBH1A9 
2 BBDD4S4 
©BOAO17 
eDABOO7 
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eDADDSL 
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10090000 
0999994 
0999929 
0999478 
0997708 


©992496 
0979659 
e354178 
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0662867 
0479262 
0361275 
0258936 
0174651 


e112112 
0668335 
039696 
#21862 
eG@115i1 


0605792 
6062788 
0891286 
@OB57H 
0600242 


0290699 
0909039 
ePOO015 
#92GGG5 
eDOD4G2 


e8OOOGL 
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1 sABGAGG 
6999988 
0999848 
0999958 
2996582 


a987677 
0968686 
8932982 
e875147 
0793568 


269114] 
0575398 
0456499 
0344535 
0247213 


0168660 
0109483 
09676990 
0939919 
eD2247H 


0912698 
eO06237 
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0PB1464 
eSO0669 
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10899009 
6999994 
0999927 
0999526 
e997879 


0992913 
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e956663 
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0614554 
0491593 
0373168 
¢268432 
0183888 


0118476 
0872807 
0942555 
0923692 
0F12584 


o9G6387 
0963192 
0PO1444 
©P9O645 
eDDK277 


eOOO115 
eDDOO46 
0446018 
©BGS907 
eDBS6G62 


eA4GOG1 
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16994800 
#999989 
0999861 
0999134 
0996369 


6988491 
3979527 
2936397 
e88G814 
08081657 


eTB1279 
#586904 
20468371 
0355764 
0257817 


#176628 
0115498 
oB71957 
0G42758 
0924266 


0013171 
ofD6846 
0983413 
0921634 
0986752 


0989334 
0990143 
©9D9659 
©990623 
2D9OGH9 


2P9GDO3 
0606801 
2BO9OO1 


A=1202 


10892000 
0999995 
0999934 
0999559 
0998937 


2993393 
69828664 
2959826 
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0626066 
0503851 
0384969 
0278966 
0191718 


@125635 
0877468 
2945658 
0825636 
eB1L3734 


08978631 
8OO3445 
«801618 
02O073B 
8909316 


#846132 
6980G53 
eAAAA2Z1 
©B8OB48 
PBDDABS 
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0999999 
8999873 
€999283 
6996636 


8989253 
0972274 
6939739 
©886265 
0889419 


0711265 
6598278 
6489202 
0367053 
#266969 


€184749 
0121765 
8976399 
6845756 
8826169 


0814318 
€8O07583 
6003771 
0991821 
0906845 


®BOO378 
#406163 
©DOOG68 
e46GR27 
©F4OOO11 


PBBDADS 
eABABGL 
@BAOAG2 


A=1203 


18BAdKGD 
2999995 
#999939 
0999595 
29981283 


8993842 
€983164 
a361272 


A21008 


0637396 
6516831 
0396872 
0289630 
8298536 


0131866 


0927698 
8014965 


6087728 
€983826 
0001814 
4668823 
8999368 


8020152 
aDOON61 
eFBBA24 
#8293089 
ePIABOS 


4G0G601 
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lafagaga 
2999991 
0999885 
0999268 
0996883 
0989968 
0973925 
0942968 
2891598 
0816979 


e72G919 
9669489 
0491982 
0378391 
e277G33 


0193451 
9128104 
0981818 
«48889 
0828183 


6015542 
0808219 
0024160 
0602025 
0809948 


08O0427 
0069186 
2BOBB78 
#900832 
eBhOG12 


eDAAAAS 
809982 
oBOOGOL 


A21204 


168900608 
6999996 
6999945 
8999628 
€998319 


9994262 
0984290 
3963406 
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8 0896547 
9 0824317 


16 0730417 
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13 2389768 
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16 0134694 
17 0985816 
18 0852177 
19 0938312 


20 0f16847 
21 eDO897H 
22 0894582 
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24 #901961 
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27 ©988S89 
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31 «9DGBG2 
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AF1265 


x 

@ 12849906 
1 0999996 
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3 0999659 
4 0998445 
5 0994655 
6 0985177 
7 #965433 
8 2930175 
9 2875984 


16 0798569 
11 ©762925 


12 0594239 
13 0481625 
14 0372165 


15 «274968 
16 0193971 


17 0138692 
18 0984163 
19 2951852 


29 0839594 
21 0817368 
22 09S940G 
23 0264986 
24 0802464 


25 661192 
26 0D20557 
27 0O99251 
28 «086199 
29 088GD46 


36 ¢900G19 
31 2BOSGB7 


32 #BO8GO3 
33 ©BBDGG1 
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a 10808960 


A=1128 


09461388 
0831426 


0739698 
0631468 
0515349 
491174 
0296538 


0216188 
0141472 
029D794 
0055618 
0932558 


0918236 
0009786 
0895039 
#8G2492 
0661185 


0BOO543 
@BOG24G 
2068162 
09GGB42 
eDOBD1L7 


eDDGOG6 
e86G902 
ePOGBBL 


A=1206 


10860905 
2999997 
0999954 
0999686 
0998562 


0995621 
0986897 
0967356 
0933624 


0889494" 


0896114 
0712394 
#695942 
0492322 
0383071 


0284745 
0262151 
01371968 


0988988 
0655154 


aO32776 
0618677 
916218 
0065373 
0962719 


261326 
6966623 
096283 
oB00124 
#068053 


#BDGH22 
*%OGDO9 


#GBO8GO3 
DODBOL 


A=1304 


10964989 


A=1129 


0996935 
2838316 


0748762 
06422066 
0526926 
0412609 
0387953 


0219803 
0148436 
9995952 
0059213 
0934925 


0619713 
0919661 
0865532 
ef92758 
0401322 


’ 
2669611 
eDGBH272 
©8G117 
©GBH049 
2BB0S20 


0909568 
0989803 
eBFGOO1 


A=12.7 


10G45404H 
2999997 
0999958 
e999712 
0998676 


0995363 
0986963 
2969182 
0936923 
0885711 


0813446 
0721669 
0615788 
0563566 
0394612 


0294631 
0219488 
#143786 
0993865 
0358602 


eD35871 
0626129 
#911993 
o3D5876 
0962996 


0641471 
0600697 
0969319 
0966141 
0698666 


#OB8G25 
eDB4G10 
eDBGDO4 
2GOO6892 
oDBAGG1 
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A=1206 


0918496 
0844972 


0757698 
0652771 
0538493 
0424935 
0318464 


0227975 
0155584 
0191291 
2962966 
0937417 


0921289 
08211598 
0906665 
@DO3B47 
0801473 


0866686 
#960398 
909133 
0260956 
e969G23 


#992559 
2f00G03 
#690801 


A=12.8 


10DB9GGG 
0999997 
2999962 
0999736 
0998771 


2995683 
0987778 
e979914 
2949077 
2899738 


0826567 
273D749 
0626232 
2514748 
0494979 


0384619 
0218978 
0159465 
0498879 
#862196 


0B37483 
021667 
0912626 
#®G64i7 
2B43290 


0991631 
20620778 
#838359 
968169 
2000069 


#060929 
®660012 
©9D9995 
eBB8OG2 
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10889696 
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0914774 
0851416 


0766235 
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0329964 
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0186811 
0366879 
2049936 


022941 
0012599 
©9B6640 
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0808348 
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0BB9626 
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0992901 
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2995981 
0988545 
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0827481 
0739632 


0636699 
0525866 
0415963 


0314798 
0227615 
0157462 
0194122 
0665939 


049614 
#823293 
of13921 
#296999 
0293626 


0961865 
0020868 
0539403 
e006181 
2008079 
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eDBROGL 
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0918875 
0857645 
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0561675 
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0246366 
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0112511 
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0942786 


0B24789 
#013667 
0807258 
203763 
0901818 


#096866 
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eDBDB73 
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2998958 
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0945972 
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0748318 
0646835 
0536895 
0426955 
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0236393 
0164567 
0199535 
2869833 


0242669 
0925912 
0214681 
0987622 
063972 


0901994 
0f20966 
0609452 
©BO6264 
2900989 


e2GGO38 
©DOG6Gi6 
@DGDGO6 
@DOHGO2 
6906961 


A=1328 


10996446 


A=1203 


0922806 
0863663 


0788835 
08683417 
0572259 
04583863 
0359492 


#255772 
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0118392 
8675191 
8045670 


8B26559 
0F1i4866 
€967922 
©6064973 
@G82015 


8896966 
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0896196 
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e696935 
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0437948 
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eDBBAA2 
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#976986 
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0558785 
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0254353 
6179212 
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0916406 
8099807 
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4299850 
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TABLE 11 
Az1303 A=1304 Az1305 A=1306 A=1307 A=1308 A=1309 Anl4ed 
2999998 «999999 2999999 2999999 4999999 4999999 4999999 6999999 
0999976 #599978 2999986 «999982 2999983 0999985 0999986 2999988 
2999828 0999842 2999855 2999867 9999878 4999888 3999898 2999966 
0999171 0999235 2999293 3999347 0999397 0999443 0999486 0999526 
2996988 25997199 2997396 6997579 9997758 0997989 6998057 2998295 
2991181 0991744 0992273 0992769 2993235 0993673 3994983 0994468 
2978309 0979561 0988746 2981868 0982928 0983936 0984877 0985772 
0953851 095624 0958517 2960687 0962754 0964723 6966597 0968380 
2913199 e917176 0921605 0924689 «928207 2931591 0934835 0937945 
°853193 9859915 0864736 2870270 0875619 2886788 0885781 0890601 
0773186 0781979 6. 788774 0796271 0853574 08106681 0817596 2824319 
«67656 «686138 0695547 0704783 0713844 6722728 a731434 0739968 
0569465 0586122 0590667 2601996 0611402 0621582 6631638 0641542 
0459990 0470843 0481753 0492623 0593445 0514212 0524917 0535552 
0355812 0366247 2376729 0387249 0397801 0408376 0418966 0429563 
0263522 0272869 0282207 «291711 0301313 0311696 6320784 0336646 
0186855 0194554 0262455 6219583 0218695 0227025 0235489 0244082 
0126785 0132871 0139122 #145537 0152114 0158852 0165748 0172799 
0082438 0886951 2691622 2696451 0141439 0146586 0111892 0117357 
0551394 0854565 0657872 0861316 2864996 0868624 8672492 0876505 
2930750 0032867 2835991 0937424 0339870 0942431 0045114 0647998 
0017676 0919622 0028446 #821951 0023541 0025218 0026985 aB28844 
2009772 e8i958a 2011459 0812386 0013373 0914421 6815533 0816712 
©OO52G1 «995675 6806184 2906731 3897316 0087943 688613 3869328 
2002668 0662932 0003217 0003526 0863859 0004218 0004604 0005620 
2001321 2061461 0901615 #801782 0031964 0662161 6902376 #802698 
2229631 6900704 2808783 2B80870 2006966 «0910679 6001184 2901309 
2999292 0909328 2000367 6OB0411 099459 0060512 0600571 0990635 
0909131 008148 2006167 0099188 2886211 0290237 0908266 0686298 
#229057 ©O00G64 2900973 0999083 0990094 2620197 8090126 6890136 
2999024 0009027 6069031 #890036 0800041 «990046 6000053 0899960 
°38G018 o9GG011 ¢O06G13 2B90915 2890017 oB9G020 @GHGHK22 aBGAR26 
*DBOOB4 4960004 29000605 0D00096 0990097 +999008 6999909 0D9G011 
2892001 #269002 2000082 0BB9062 0992003 2090003 8000004 3998004 
©99B991 6049901 2269901 6969901 0GFBOGOX 0090001 6490001 ©D9AGH2 
= 6900001 2893081 
A=14e1 A=1402 A=1403 Azlhed A=14.5 A=1406 A=l4eT A=1408 

10000000 146000950 12000900 1.000900 1.809000 
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8999269 


6990158 
6OOGH91 
8O9OG52 
2%OGGB29 
eDBOG16 


#84O969 
©DBDGAS- 
© BGOOG2 
eDBSAA1 
*PBSOB1 


Ar44 


108606906 
2999999 
0999997 
0999992 


0999982 
3999958 
0999998 
0999889 
2999626 


6999272 


A=37 


3999141 
8998336 
a996961 
8994498 
0999632 


8984672 
0975852 
8963299 
0946598 
0923367 


8894366 
6858598 
08159867 
0766545 
#711261 


0658973 
8587303 
0521865 
@456427 
e392711 


0332262 
0276347 
e225887 
0181435 
0143185 


0111620 
eD84573 
0063361 
8046555 
6033646 


0623899 
0816686 
6911453 
#207729 
6905134 


0893349 
082151 
6961359 
0D9B845 
80S9517 


0069312 
#990185 
#950198 
#000062 
0606035 


+090029 
6OOOG11 
@ADDOK6 
0929503 
©9BBB62 


ePOOOO1 


A=45 


10099905 
6999999 
6999998 
0999996 


6999994 
0999976 
6999947 
2999887 
3999779 


999551 


An38 


0983364 
0974126 
©961125 
0943481 


0929369 
0891974 
#855176 
0812546 
2763457 


2788593 
0649626 
0586151 
0521575 
0457998 


0394981 
0334397 
«278907 
0228784 
0184488 


0146233 
0113929 
0687243 
965667 
048586 


0035339 
0B25272 
oG17774 
0812289 
0998359 


0095593 
0893683 
0962386 
0991522 
©906955 


©8BG590 
#090359 
0209215 
©8860127 
eBQBBTS 


©G2G942 
eB2DGG24 
e996013 
eDBOOOT 
eBDOGD4 


2O2GOG2 
©A9BGGG1 
288DOG2 


Az46 


1efD0086 
«999999 
0999998 


2999994 
0999987 
2999978 
0999934 
0999862 


- «999726 


Ax=39 


0988783 
0982626 
0972382 
0958948 
340883 
0917398 
0887852 
0851843 
889287 


#760472 
0766679 
0647153 
0585042 
0521297 


0457551 
2395399 
0336279 
281382 
#231592 


0187459 
0149211 
0116783 
0989875 
068012 


050611 
0837638 
#826659 
eO18874 
013146 


©D49809 
@D66976 
0664033 
0002635 
0891695 


oOS1074 
©O8G679 
0996412 
996249 
0989149 


©fGD087 
669951 
929BO29 
089016 
©9DBBB9 


4968005 
28088063 
#DOOSO1 
0099001 


Az47 


1sBGSS0G 
2999999 


0999997 
8999993 
0999983 
0999962 
2999919 


9FF9834 


A=49 


0992434 
0987689 
098661 
0979626 


0956771 
0938366 
0914479 
0884696 
0848596 


0896124 
0757586 
0763654 
0645349 
0583976 


05219629 
0458082 
0396678 
0338163 
0283776 


0234315 
0196356 
0152119 
0119583 
2692469 


076335 
0952628 
oD3874G 
of28G57 
0819995 


0914022 
«949679 
2896576 
0984399 
0902898 


0991885 
0OO1261 
0690756 
0238469 
2866287 


0066173 
0858193 
oDOOG6G 
0206835 
eDDGG26 


0990611 
oBBBNGE 
eDDGOO3 
0DBBOG2 
oPDDOG2 


099001 


A=48 


1.842000 
2999999 


0999998 
0999996 
0999999 
0999978 
0999952 


6999981 


TABLE If 

Az41 A242 
0994999 0996737 
0991683 0994454 
0986646 0998982 
0979272 0985576 
0968846 0977861 
0954597 0967960 
0935751 0952427 
0911696 0933221 
2881607 20938777 
0845431 0878581 
0883455 0842347 
0754792 e8B9973 
0741312 0752987 
0643616 0699049 
0582949 0641931 
2526771 0581958 
2458593 0528522 
0397896 0459886 
0349821 0399978 
#286093 0341799 
#236958 0288338 
0193164 #239525 
#154961 0195986 
0122329 0157739 
0095025 0125624 
0D72636 0997544 
0B54636 0B74913 
0B49444 0956634 
0829466 0942149 
0921136 0830883 
0914916 eD2228H 
2019367 015827 
0987095 911673 
0804781 0997630 
0983174 8995179 
e842075 0BA3464 
€961337 0002282 
#200849 0901482 
00O0531 0299949 
#809328 0898599 
e9BH199 22372 
2990119 0946228 
0800971 0986138 
2090041 90DOG83 
eBAGD24 0498B49 
4489G13 ¢$89928 
sBBOANDSB eB99816 
2890004 ®DO99D9 
e2O9SG2 eBhOGAS 
2800961 8B99003 
sBO9OG1 eFBO9G2 
0$D40G1 

A=49 A=5Q 
108804660 12995886 
«999999 6999999 
0999998 2999999 
0999995 2999997 
0999987 2999993 
0999972 6999984 
2999941 09399965 

526 


A=43 


0997896 
0996348 
0993882 
0999895 


0984479 
0976431 
0965266 
0959264 
0938715 


0985993 
0875615 
0839339 
0797176 
2749465 


0696868 
0643319 
0581462 
0529282 
0459562 


0406221 
€343518 
©299513 
0242619 
0198577 


0169454 
0127668 
0196625 
0977167 
0958622 


0843853 
2932398 
0623442 
2916754 
0911796 


0768182 
0065592 
ePO3767 
0932569 
0961636 


0081956 
eDSO672 
6988421 
0000261 
#99G159 


©DBGSI6 
e3280657 
02866833 
¢D20619 
*DOOG12 


eP2GO06 
eASGSGS 
0299062 
0DD9G61 
290801 


1eBG69G0 
6999999 
2999998 
2999996 
0999991 


0999986 


Az4d 


8998663 
8997624 
8995937 
0993285 


8989261 
0983359 
6974983 
0963466 
6948289 


8928236 
6993252 
0872717 
0836464 
8794358 


8746922 
2694742 
8638744 
0580979 
0529956 


6466821 
6491326 
6345183 
4292623 
0244444 


#261181 
#163169 
9139263 
8162476 
0079397 


0960596 
0645556 
6033738 
6024616 
4017696 


#912535 
68G8750 
9046824 
6BH4083 
0802736 


0691799 
0861170 
©BGA75H 
6O00474 
2996296 


04906182 
e600111 
#B9D966 
#999839 
@ABOH23 


#269913 
eADOAAS 
eDDB9G4 
8BBOGA2 
SAAGHAT 


2OAGS01 


189606906 
2999999 
2999998 
8999995 


2999988 


A=45 


0999156 
8998473 
8997334 
0995593 


8992663 
0988402 
6982218 
8973520 
2961661 


0945964 
6925782 
a99G556 
a869874 
0833541 


0791618 
0744455 
2692698 
2637228 
0579187 


6519826 
6469465 
6462395 
0346796 
0294671 


0246892 
8283729 
0165786 
0132889 
0194878 


©081602 
0862558 
0947255 
035174 
0825800 


0918651 
0913289 
6009334 
0006463 
0984412 


2052970 
0661972 
0A01291 
0009834 
0299532 


8890334 
eBOA2RT 
©DOB127 
eBBOR7T7 
09846 


°090027 
aBOGH16 
6999909 
0390005 
0800003 


2098042 
#GDGSO1 


A=53 


10990200 
999999 
0999999 
6999997 


6999993 


swat EL” 4 


























A=46 


0999474 
0999929 
«998276 
0997824 


0995948 
0992017 
0987520 


0981956 
0972645 


0959853 
«943836 
0923356 
«897962 
0867599 


0839746 
© 788951 
«742069 
0698762 
0635762 


0578324 
0519669 
0460895 


- 493436 


0348359 


0296668 
0249997 
0286197 
0168247 
0135369 


0197251 
0883784 
0964568 
0648951 
0936613 


0626994 
0@19619 
0914958 
0839932 
966919 


2D84754 
e003221 
©862153 
0981420 
#280924 


©99G593 
0000376 
©6806235 
0906145 
©BDGG89 


«030053 
«000932 
#909919 
*8O3911 
°B20006 


BBG D0S 
+D29GD2 
*P2OGO1 
+BBGGG1 


A=s47 


0999676 
0999389 
0998891 
0998954 


2996697 
0994572 
0991349 


«986616 
3979876 


0979558 
0958645 
e9417H9 
2929958 
0895292 


0864361 
0828917 
0786355 
0739733 
0688774 


0634341 
0577488 
0519399 
e461311 
0404432 


0349875 
6298592 
0251331 
#208614 
176733 


0137762 
@199588 
0085941 
0866443 
@B5B642 


0938056 
0928196 
©B28690 
0014841 
0316545 


067398 
©9G5208 
0903484 
0BB2344 
#OO1556 


0991628 
2089664 
0406421 
0698265 
eOSG165 


eDOG1G1 
©0DOG62 
oDAAD3T 
©9BGG22 
#BOGD13 


eABOOG7 
*PBGBO4 
e2BDBG2 
ePGDGG1 
e2OOGO1 


A=48 


#999892 
09996295 
2999296 
0998741 


0997822 
0996351 
0994875 


0990659 
0985692 


0978679 
0969061 
0956237 
0939691 
0918587 


0892724 
0861687 
0825352 
0783826 
0737472 


0686993 
0632964 
0576679 
0519196 
0461714 


045454 
0351347 
0369476 
0253597 
0219974 


0173167 
0140171 
2111896 
0988673 
0968363 


0652328 
0939596 
0829466 
eO21591 
0015637 


0011171 
eAG7873 
0885475 
eD63757 
0OO2544 


@DD17TGDA 
0861122 
©BO073G 
#009475 
2869298 


e2OG187 
0866116 
eDOOG71 
#BO3643 
0969626 


2809015 
2BB9659 
2460095 
©D96GG3 
©DO66092 


+8S09G1 


TABLE 


A=49 


0999885 
0999766 
0999558 
0999194 


0998579 
0997575 
2995988 


0993558 
0989949 


0984748 
0977467 
0967556 
0954432 
0937568 


0916244 
6899197 
2859967 
0822748 
0781362 


0735273 
0685487 
0631628 
o575894 
2518999 


04621904 
0496347 
0352777 
0302297 
0255627 


0213278 
0175549 
0142537 
0114157 
09996181 


2B7H269 
0954008 
2849945 
©D3G622 
0922592 


0016445 
011819 
oBD837H 
0695854 
#BB4B4G 


0642753 
0901851 
0601229 
#B0S806 
0088522 


0899334 
0696211 
206131 
@D8BG81 
0669949 


eB29039 
0966918 
eOOG9G190 
#BDDDO6 
@DBOBO3 


eBDDGG2 
oBOGGG1 
2669901 


527 


iI 


A=58 


2999928 
3999857 
0999725 
2999489 


0999983 
2998466 
0997314 


0995697 
0993621 


0989219 
2983786 
0976241 
0966645 
09526293 


0935434 
691393 
0887711 
0856498 
0820293 


6778966 
0733134 
0683322 
0639332 
e575133 


0518888 
0462483 
0487263 
0354166 
0384675 


e257694 
0215536 
0177883 
0144859 
0116391 


0092265 
0972168 
0055681 
0642391 
0931843 


023653 
eB17265 
0912463 
268879 
@BD6244 


0964335 
e6O2971 
0942916 
0891343 
6200836 


6900578 
oBDG372 
0990237 
6BOG149 
0099092 


6OBG957 
eO98G34 
eBSSG21 
@S9OG12 
eBDDSO7 


2B9GOG4 
8DBOGG2 
800661 
*2DGGO1 


A=51 


0999958 
0999914 
0999831 
099968 


0999414 
0998963 
0998221 
6997838 
0995259 


0992466 
2988469 
2982897 
0975953 
0964529 


0958831 
0933367 
0911644 
0885265 
0853979 


0817716 
0776617 
0731651 


2681607. 


0629873 


0574395 
0518623 
0462851 
0408152 
0355516 


0305865 
0259716 
0217730 
0186169 
0147142 


0118591 
0894324 
8974935 
0057346 
0043836 


2B3307 
0924623 
0G18G95 
0913127 
0DG944G 


4DB6646 
09B4639 
0903198 
#002177 
0861463 


0966972 
2026637 
eBOO413 
#ZGS265 
©G09167 


0820165 
eASOG65 
0DBGD4G 
0D9GG24 
2OBO014 


2299998 
2BG8G5 
sGDG803 
eDD9GG2 
8BBOOG1 


8989051 


A=52 


6999975 
0999948 
0999897 
2999852 


2999634 
8999332 
0998834 
6998924 
8996747 


8994794 
2991893 
8987782 
6981813 
0973754 


8963688 
#949939 
0931321 
0999386 
2882859 


0851549 
815283 
8774331 
«729823 
8679939 


#627859 
0573678 
0518443 
6463268 
0499916 


6356836, 
0307491 
«261676 
0219881 
0182468 


0149382 
128759 
6$96359 
0075895 
6959084 


6045286 
6934380 
6925659 
#618936 
#913862 


8899933 
eAA7TBS9 
€9B4954 
0OG3434 
€9B2351 


6961593 
#891962 
eBPA7TOL 
*BBG457 
8DDG295 


0906188 
e9FG118 
8DOOBT4 
8DDGO4SS 
8009628 


#999017 
8006614 
8BBOGG6 
*DAGBGS 
oADBAB2 


6BD9OO1 
oDDOOH1 


A=53 


6999985 
#999969 
8999938 
2999878 


2999768 
0999574 
0999243 
6998695 
0997814 


6996441 
0994363 
0991362 
0986918 


- 0988864 


6972495 
0961485 
0947252 
6929293 
8997156 


#889492 
8849087 
08129903 
0772106 
e727B47 


0678316 
6626661 
0572981 
©518268 
0463555 


2499856 
6358199 
0309134 
0263596 
0221984 


6184693 
0151584 
0122895 
8098370 
eB77739 


0060653 
2946722 
0635534 
6926685 
eG19787 


0914489 
6918478 
6007483 
0905279 
020367" 


6982532 
ePG1722 
0991158 
*O9B769 
8998505 


eDOO327 
@BGD218 
0399133 
0809083 
©DOBG52 


@BBOH32 
8848919 
@BBGG12 
eDB9OBT7 
eAOOGR4 


8h OGOH2 
$2601 
6399901 





A=54 


10BGDBOH 
0999999 
2999998 


999996 
0999992 
0399982 
2999963 


0999925 


0999856 
0999731 
0999514 
0999147 
0998547 


0997593 
0996122 
0993915 
0999695 
0986118 


0979781 
0971227 
29599668 
0945473 
0927281 


09B4954 
«878162 
«846711 
0819575 
© 769922 


0725122 
0676736 
0625565 
0572304 
0518998 


0463893 
0419673 
0359354 
0316735 
0265476 


0224641 
«186755 
#153747 
#124999 
0196357 


#079566 
0962293 
0648161 
eO36771 
eB27726 


0820647 
#015186 
#911933 
«007918 
o2O5614 


0663932 
©9G2721 
0091861 
991258 
°DDG84G 


#990555 
©B9G362 
©O9D234 
©9OG149 
*O99G94 


6008059 
#690936 
#B9BPH22 
299013 


-A=55 


15800006 
“#999999 


9999998 
4999995 
3999989 
7999978 
9999955 


9999911 
"9999832 
2999691 
2999448 
0999B43 


#998389 
“2997369 
2995788 
6993452 
0999671 


6985303 
2978746 
2969951 
9958434 
0943792 


2925287 
2962781 
0875879 
4844386 
0868297 


27167795 
0723244 
6675198 
6624389 
0571645 


0517933 
0464221 
0411468 
9369566 
0312297 


0267301 
0226054 
0188864 
2155874 
0127872 


#192321 
eO81377 
0863924 
4049597 
038009 


928773 
021515 
#915893 
0911598 
0868363 


0835958 
0094194 





2801364 


0366916 
#90608 
SBOD490 
€8GB259 
0996167 


200196 
eDOSD66 
eDGBS41 
#26%@25 


A=56 


10999000 
0999999 


4999999 
2999997 
0999994 
0999987 


0999973 


0999946 
0999896 
2999805 
0999646 
0999376 


0998932 
0998221 
0997115 
0995441 
0992974 


0989432 
0984473 
3977708 
0968669 
0956968 


0941939 
0923312 
0980635 
0873615 
0842992 


0866966 
0765717 
@721412 
673699 
0623285 


0571694 
0517772 
0464546 
0412243 
«361748 


313821 
0269998 
#228624 
#199933 
2157963 


0129115 
01842606 
0683172 
0965546 
0551936 


0939249 
0029825 
0922391 
0916619 
0f12174 


0298818 
0006312 
0BB4465 
#963122 
0®G2158 


0001475 
0306996 
@DO%665 
2S60439 
oOOK287 


2999185 
9900118 
eDG6075 
@DOOG47 


TABLE 11 
A=57 A=58 
1 eBB200@ 
4999999 10999990 
0999998 2999999 
0999996 2999998 
2999992 2999996 
0999984 2999991 
0999967 399998B 
0999936 2999961 
0999878 2999924 
0999775 «999858 
0999597 0999742 
0999299 0999544. 
0998813 2999215 
0998043 0998686 
2996858 0997856 
0995686 2996589 
0992481 0994795 
0988778 0991974 
0983636 0988110 
0976643 0982774 
0967381 0975577 
0955383 0966489 
0940186 0953861 
0921354 9938442 
0898516 0919415 
0871395 0896425 
0839847 0869213 
0893882 2837643 
«763685 681742 
0719624 0761699 
0672237 6717879 
2622218 0670812 
0570379 0621178 
0517615 0569771 
0464851 0517463 
0412997 0465154 
362991 0413732 
0315369 0364925 
0279838 0316762 
0229953 0272548 
2192963 0231843 
2169018 0194954 
#1321128 6162038 
0106177 8133111 
6984956 9198671 
0@67157 0086712 
0052459 2®68759 
0D40498 0053883 
0930882 0O41731 
0023275 0031942 
0017335 0824165 
#912760 0018069 
6969283 0913355 
«906675 6909757 
8OB4744 oBB7G47 
0993334 0885932 
0092316, 6903553 _ 
0601591 2062486 
0981989 2861712 
#090726 2901169 
2090482 28006789 
PO9317 eBON527 
20206 0990348 
0969132 2809228 
0909084 ©690147 
528 


A=59 


1leAQaege 
0999999 
0999999 
2999997 


2999994 


2999988 
0999976 
2999954 
0999912 
0999836 
0999786 
0999486 
¢999126 
69985514 
0997659 


6996369 
2994318 
0991453 
0987428 
0981906 


e97T45G1 
0964793 
0952349 
0936709 
0917495 


2894369 
e8670661 
6835479 
0799646 
6759757 


0716174 
0669421 
0625164 
#569179 
0517314 


0465459 
0414449 
0365121 
03181890 
@274226 


6233693 
6196908 
8164624 
0135666 
0169941 


0988458 
6878359 
©9553G3 
0942973 
0B33067 


e925861 
6018811 
6613959 
eP1G241 
60867428 


e995328 
0903779 
0922656 
#691839 
0901262 


#9GG856 
0895575 
¢99G382 
@P9O251 


A=66 


1eBZBO9O 
2999999 
4999998 


0999997 


8999993 
0999986 
8999972 
8999945 
0999897 


0999812 
0999666 
6999424 
0999939 
0998468 


4997452 
0996017 
2993918 
€999919 
0986734 


0981027 
8973418 
8963493 
€959823 
8934986 


6915593 


0892322 
6864944 
6833354 
8797592 


0757857 
0714509 
0668064 
6619176 
8568641 


0517169 


8465738 
0415149 
¢366192 
@319567 


€275855 
0235506 
6198826 
8165977 
8136993 


0111799 
6098187 
0671932 
eO56717 
8944213 


034975 


0925964 
0919561 
08314571 
0B19733 


aAS7818 
#905632 
©9B4G12 
6992827 
6961971 


8091359 
8299927 
80D9626 
6006418 


Az61 


10899900 
#999999 


#999998 


8999996 
0999992 
0999983 
0999966 
0999936 


6999881 
$999785 
0999623 
8999356 
0998928 


8998257 
8997235 
0995714 
2993505 
0990371 


8986027 
0989137 
0972328. 
0962191 
8949310 


9933274 
8913710 
2899311 
9862861 
0831267 


8795579 
0755997 
0712882 
0666739 
0618211 


0568038 
0517828 
0466918 
0415831 
0367238 


6.326922 
a277456 
0237284 
#296709 
8167898 


0138892 
#1123616 
6091899 
2273590 
0858126 


0845453 
0635145 
8926872 
0620317 
6815192 


aG21234 
4008216 
09B5943 
694253 
0993910 


" 0982168 


0601468 
#G91801 
8690679 


89 


9g 
e1 
92 
93 
94 


95 
96 
97 


99 


160 
181 
162 
193 


28 
29 


36 


32 
33 
34 


35 
36 
37 
38 
39 


49 


42 


43 
44 


45 
46 
47 


49 


56 
51 
52 
53 
54 


55 


57 
58 
59 


66 
61 
62 
63 
64 


65 
66 
67 
68 
69 


76 
72 
73 
74 


75 
76 


A=54 
#899908 


9200065 
sBDBODBS 
eDBDBH2 
*BSSGO1 
*BDGGO1 


A=62 


162HDGOH 
2999999 


0999998 
0999995 
0999996 
2999979 
2999969 


0999925 
2999863 
2999756 
2999577 
0999284 


‘0998819 
0998999 
©997G9 


0995456 
0993886 


0989811 
0985398 
0979238 
0971231 
«969888 


0947851 
0931574 
0911846 
0888325 
«8628889 


0829217 
2793665 
o54177 
0711296 
0665445 


0617269 
2567488 
0516898 
2466292 
0416498 


2368259 
0322247 
0279624 
02399026 
#262557 


0169789 
«148765 
0115428 
0993595 
0875959 


0859529, 
0046691 


A=55 
2060615 
#BB8059 
«9BBBOSE 
oBDS003 
4BGGAG2 
*BODIOL 


eOhOOG1 


A=63 


1eABH994 


A=56 
*BG2B29 


*406018 
eDAAALL 
9DDO0G6 
*FAOAB4 
*BSZBH2 


oDODOAGL 
*DO9GG1 


A=64 


2999999 12863490 


2999999 
0999997 
2999994 
2999988 
0999976 


0999953 
2999913 
«999843 
0999724 
0999527 


0999207 
0998704 
4997932 


0996773 
0995675 


0992644 
2899249 
9984578 
0978329 
0976128 


0959583 
#946297 
0929885 
0919001 
0886365 


0858796 
0827293 
0791669 
0752394 
0769733 


0664180 
0616550 
#566951 
0516755 
0466566 


0417149 
¢369258 
0323544 
0280559 
0248735 


0264373 
#171648 
0142616 
o11722 
0f95275-- 


eD76607 
0266926 


2999999 
«999998 
#999996 
2999993 
2999985 


0999971 
0999946 
0999996 
0999822 
0999689 


2999472 
0999125 
0998583 


0997757 
0996527 


0994739 
0992195 
0988656 
0983838 
0977412 


0969629 
0958279 
0944799 
09282088 
0998174 


088443 
0856801 
0825224 
«789776 
2750648 


0768211 
0662944 
0615452 
0566427 
0516624 


0466821 
0417784 
0379234 
0324812 
0282662 


0242419 
0266157 
0173478 
6144436 
6118964__ 


0896938 
oB78143 


TABLE I! 

A=57 A=58 
#3GBH53 8BG4994 
©84HG33 8BPBD6O 
eBBAD2B 0964037 
#960912 2BDOG23 
*8G9OR7 0896014 
*BBABG4S *2BB689 
29G32G3 2O60405 
®DA9DO2 9%8GGG3 
*DDBGO1 aBOGOG2 
2800001 #890651 
e2OSAG1 

A=65 A=66 
16BBBIBG 1 6GAGGOG 
2999999 2999999 
«999998 2999999 
0999996 2999997 
099999] 2999995 
2999982 2999989 
2999966 0999979 
0999937 0999964 
0999886 0999927 
0999798 0999875 
0999652 0999772 
0999414 0999611 
999938 2999352 
6998455 0998945 
2997574 0998326 
0996272 6997383 
0994392 0996998 
0991736 0994935 
0988062 0991266 
«983987 0987457 
0976488 0982327 
0967988 0975556 
0956974 0966792 
0943306 0955676 
0926543 2941819 
0996366 0924891 
0882526 0984577 
0854842 2889635 
0823279 2852913 
a787967 0821367 
0748938 2786979 
8786721 0747261 
0661736 0795262 
0614574 0664554 
0565915 0613716 
0516496 #565415 
2467676 0516376 
0418496 0467326 
3371188 0419613 
0326654 0372122 
0283536 8327269 
0244854 8284979 
0267910 0245668 
0175279 8269632 
0146225 0177652 
0120794 0147994 
0998586 0122423 

529 















































A=59 
0966163 


69DA1GS 
oD55067 
02GO642 
629GG26 
#260616 


6OGGG19K 
©9SGOG6 
ePOBAGS 
*BDG8G2 
oDAGG1 


0$GG601 


A=67 


16999660 
0999999 
0999998 
6999997 


0999993 
2999987 
0999975 
0999954 
0999917 


0999852 
0999744 
0999567 
0999286 
0998847 


6998279 
2997184 
0995734 
0993668 
0996785 


0986842 
0981558 
0974617 
0965673 
0954367 


0944339 
0923251 
0982866 
0878774 
0851813 


0819487 
6784284 
0745618 
© 7D3834 
0659307 


0612877 
0564925 
#516247 
0467576 
0419667 


0373035 
0328459 
0286395 
e247251 
«211325 


0178797 
0149739 


A=6 
6206276 


@9AD181 
eDOGLIT 
@BD9G75 
CDIBG4T 
sOODR39 


#968619 
eOAOG11 
sADDAGT 
SPPBGAS 
e4OAOHS 


aOO9OGR1 
6O9G561 
eBDOOH1 


A=68 


1eBDGDBD 
8999999 
6999998 


3999996 
0999992 
3999985 
8999971 
0999947 


0999965 
0999833 
6999714 
0999521 
0999215 


6998743 
2998830 
0996977 
0995452 
@993292 


0999294 
e986217 
8988781 
e973672 
0964551 


0953666 
0938866 
#921623 
8981953 
0876936 


0849141 
6817639 
6782522 
6 7T446A7 
0782435 


0658265 
#612656 
0564447 
0516128 
#467848 


0429189 
8373934 
8329626 
8287783 
8248896 


212989 
€186516 


A=61 
809G456 


#890303 
6998199 
8990130 
#046083 
PAOBBS3 


eBBBA34 
4990621 
@9B4R13 
6BDBGA8 
8BBGGAS 


BDABDAS 
8BBOGH2 
622O901 
8PDDGH1 


A=69 


19996029 
8999999 
0999999 


6999998 
0999995 
99999) 
0999982 
0999967 


0999939 
0999892 
#999812 
¢999681 
0999479 


@99914f 
8998634 
0997876 
6996762 
#995166 


0992985 
0989793 
0985582 
6979995 
6972721 


0963427 
0951767 
0937499 
#920869 
#899319 


0875122 
0847296 
e815821 
#788792 
0742427 


0791964 
0657157 
#611253 
6563979 
0516619 


4468041 
0420757 
0374896 
6330768 
e289144 


6259333 
0214626 


89 


96 
91 
92 


94 


95 
96 
97 
98 
39 


164 
161 
142 
143 




















164 


165 
166 
107 
198 
109 


119 


1212 
113 


A=62 


0836217 
0627784 
of21981 


00158296 
e611743 
0998623 
«996263 
2DO45HH 


0993199 
©BD2256 
0901566 
«901679 
#DOO735 


«DOB496 
0690331 
9BOG219 
006143 
2908993 


oBDDDED 
#DD6938 


oDOD024 
©900015 


#282009 


oDDGOOE 
0200903 
#DOBHG2 
+DOGBO1 
2FB0GO1 


A=7B 


1eBD0G06 
0999999 


0399999 
0999997 
0999994 
«999989 
0999979 


2999961 
09999306 
0999877 
«999789 
0999645 


2999417 
2999961 
699852 
0997714 
996539 


«994859 
0992509 
0989282 
2984939 
#979292 


0971766 
0962391 
0950471 
0935942 
0918407 


©897683 


‘A=63 


0947927 
0237292 
2628761 


#021851 
2916456 
0912261 
0809037 
0386590 


09G4755 
0893395 
0392398 
9O1677 
09021168 


aBSO79S 
0660539 
©OO%361 
000240 
0000158 


2809103 
seats 
2338824 
0000017 


2890910 
2039006 
260B004 
0494002 
2OOSO01 


¢0$0001 


A271 


1 oB600GH 


0999999 
0999998 
0999997 
0999993 
0999987 


«999976 
0999956 
0999921 
0999862 
0999764 


0999667 
6999366 
0998978 
0958408 
0997546 


2996398 
0994550 
0992193 
e98B762 
0984287 
0978492 
2979895 
0961174 


0949177 
0934491 


2916818 


A=64 


0062316 
0949161 
0838367 


0829623 
022627 
#017146 
0912786 
0969459 


0906925 
0295016 
003596 
0882552 
0BB1792 


0861245 
0BO0857 
0940584 
06O9394 
0800263 


aBDB174 


0892030 


0989619 
0BOAK12 
eBOBAG7 
eShDAA4 
o®OORGS 


eBO9SG2 
ofS99G1 
6268901 


A=72 


14890889 


2999999 
0999999 
2999998 
0999996 
0999992 


2999985 
0999972 
0999949 
0999919 
0999845 


2999738 
0999567 
€999299 
0998889 
0998274 


e397371 
3996970 
©994233 
0991689 
0988234 


0983626 
0977595 
#969841 
0S69B46 
0947886 


0933048 


TABLE IT 
A=65 A=66 
0079669 0186217 
2063780 0781183 
0859393 eB65977 
0039444 0951622 
#639548 08406521 
4223409 eG31476 
#B1775S 0G24196 
0813318 0018467 
0999889 6913858 
eDB7267 0916326 
0605285 0907616 
0983894 eAS5565 
0002718 0004017 
e9G1911 0942874 
801334 0062835 
2OAN922 0691427 
0900631 2900991 
©PGB428 0896681 
eBGA287 0866463 
@FNG199 990312 
09002125 0900269 
6960982 2990138 
0886953 @DD9DID 
eBOOD34 eB8B59 
ePOAHN21 0903038 
0989913 0B9SG24 
29O9808 8998915 
e2BAGH5 aPAGAKD 
e2B2OB3 e9OOGGBE 
#DODHG2 oP DOBG4 
oBO0001 @B9G2G62 
eDOGOO2 @DOODO1 
eP2O561 
A=73 A=74 
1 eBSODBOD 
0999999 12BGA9489 
0999999 2999999 
0999998 2999999 
0999995 0999997 
0999991 2999994 
0999982 0999989 
«999968 0999979 
0999942 2999963 
0999898 0999934 
0999826 2999886 
2999789 0999846 
0999524 2999679 
0999235 0999478 
0998797 0999167 
0998143 «998699 
0997189 0998996 
0995823 0997861 
6993986 0995574 
0991266 0993572 
0987696 0998834 
0982958 6987151 
0976782 0982283 
0968873 0975964 
0958917 2967961 
eS46650 6957789 
5380 


A=67 


124122 
0181832 
0982685 


0966447 
8952847 
0941598 
0932407 
0924987 


0919870 
6914465 
oD18771 
e@A79T72 
23058427 


0904237 
6993943 
0402164 
8001523 
2901062 


6984733 


oB29501 
8BOG34G 
290G228 
0999151 


oSDG19D 
0999065 
oDDOB42 
ePOBS27 
eDOOG17 


0966011 
eAADBOT 
eDSGGG4 
©D9OOG3 
oPFABS2 


eDODOG1 
¢9DA601 


A=75 


14666000 
€999999 
0999998 


69993996 
0999993 
0999987 
0999976 
0999957 


6999925 
0999872 
€999785 
0999646 
0999429 


6999896 
«998597 
2997864 
0SS68G6 
2995309 


«9935236 
0999394 
0986597 
- €981681 
0975146 


6966927 


As68 


4151466 
0125861 
6103431 


8684176 
8067819 
8954076 
8042676 
6633341 


a925784 
6919738 
#214958 
#911222 
8998335 


#996129 
6924463 
0963217 
8982297 
#001624 


6991137 


#020788 
O9OH541 
4080368 
8000248 


@D00166 
69460110 
eDBOG72 
8BBOO47 
BAAAASA 


0889019 
PBAAHIZ 
eAAPSOSB 
© BOHOBAS 
BBODDOS 


SAAODDHZ 
eAOOOG1 
eAAAADL 


14e4GhAAG 
0999999 
8999999 


0999998 
€999996 
€999992 
0999985 
6999973 


8999952 
8999915 
8999857 
0999762 
0999611 


2999377 
0999821 
6998491 
e997716 
0996604 


0995049 
0992879 
4989946 
0986636 
6986911 


09743190 


Ax69 


0182208 
#153158 
0127469 


6105915 
0885656 
0869165 
6655288 
0243753 


eB34277 
6826585 
0G29413 
0915518 
0811688 


4998785 
686424 
@9G4694 
6983397 
8992434 


6991728 
aOF1214 
oBAO846 
a88G583 
8909398 


8BO927H 
6096181 
9960120 
eBOGATI 
6OFGA52 


8BOAO33 
2999G21 
8BBGA14 
8886009 
eB BHGG5 


8BSO003 
eHOOHH2 
#BOSOA1 


6898GG1 


As77 


1099900 
_ 6999999 


6999999 
«999997 
0999995 
099999) 
69999583 


0999969 
0999945 
0999996 
699984) 
8999737 


e999574 
0999322 
99989462 
a998379 
3997562 


0996397 
6994765 
6992521 
098949} 
8985467 


8989216 


199 


110 


112 
113 


194 


165 
106 
187 
168 
169 


116 
111 
112 


114 


115 
116 
117 
118 
119 


126 
121 
122 
123 
124 


39 


A=76 


0873332 
0845479 
0814933 
0779G93 


0746877 
2699721 
©656071 
2619467 
0563521 


9515895 
0468269 
0421314 
0375663 
0331889 


0299486 
0251832 
0216235 
0183874 
0154832 


0129699 
0196583 
0687124 
0076513 
0B56583 


0944829 
0035215 
#927389 
0821993 
0916084 


0912145 
069981 
0866724 
#964931 
0003581 


9962576 
0961835 
0061295 
0999996 
«968627 


09BD43G 
088G293 
0820197 
#866132 
*DODH87 


©9DOO57 
eG20G37 
0ODBH24 
oBOOD15 
0890818 


©DDOGD6 
oBODB04 
809902 
*8OGHG1 
oB9OG51 


©98DGH1 


A=78 
1.900009 


A=71 


2895965 
0871563 
0843688 
0812274 


0777423 
0739356 
0698404 
0655998 
0609697 


0563673 
6515783 
0468493 
0421866 
6376504 


0332987 
e291791 
0253305 
0217818 
0185516 


0156485 
0139719 
0198135 
0888581 
oO71853 


0957714 
0945984 
0936154 
0928197 
0621778 


0016656 
0912616 
0869464 
ofD7G32 
eOD5174 


eDA3771 
#292722 
0861947 
0061379 
086968 


0200673 
0B00464 
666317 
ofOG214 
090G144 


0269995 
¢60963 
0PBDG41 
oBGOB27 
0066617 


0094611 
o26GGG7 
0DDGDO4 
206293 
oDDGGG2 


eBBOG01 
#B69601 


A=79 


A=72 


0915242 
0894224 
0869817 
0841924 


0819543 
0775783 
0737863 
0697113 
0653966 


0668944 
0562635 
0515673 
0468712 
6422394 


0377327 
0334564 
0293577 
0254752 
0219375 


0187133 
0158114 
0132321 
0139672 
6898826 


0073186 
005892) 
0846979 
sO37495 
2829059 


sG22467 
0917234 
0913993 
efO9852 
eDBT3S44 


0965422 
0933966 
0B62873 
eDG2G62 
0DB1467 


01934 
@fOB722 
0906499 
0909342 
8$6G233 


060157 
0969105 
e2DDG69 
0869645 
#985629 


#86019 
0960612 
6DDOB08 
°BBBO05 


sBDBOG3 


eDBOHG2 
eDDDBG1 
0DDO66G1 


TABLE 


A=73 


0931613 
2913678 
6892562 
#868893 


0849184 
°8S8848 
0774171 
0736398 
0695847 


0652945 
0608205 
0562295 
0515565 
0468926 


0422917 
0378135 
0335129 
0294346 
0256174 


0226907 
0188726 
0159723 
0133993 
0111194 


0891459 
0374518 
0G68123 
2948652 
2638037 


0929824 
0923161 
0917817 
0813576 
eGiG247 


0fD7662 
©5676 
eAD4165 
0963629 
0492182 


09G1557 
0991192 
e2OG772 
#900536 
09BD369 


0DB0252 
*D9D17B 
6900114 
eBB9B76 
#9DDO5S 


0290433 
2900021 
©O00014 
*9D2909 
©BGOGG5 


2BO9203 


-eBD9O92 


©DOOOB2 
©B00S91 


A=81 


531 


It 


A=74 


0945317 
0930187 
0912128 
0899917 


0866391 
0838476 
0867163 
0772587 
0734959 


0694665 
0651944 
0647482 
0561784 
0515469 


0469136 
0423433 
0378926 
0336157 
0295586 


e257572 
0222415 
0196296 
0161319 
0135467 


0112701 
0992881 
0875827 
0061321 
0949123 


@938989 
0830641 
2823865 
96184965 
0914665 


6919648 
8997987 
0965935 
2894376 
0203188 


0982365 
0061651 
0661172 
0866825 
e9SO575 


0800398 
#866272 
0900185 
0898125 
2999083 


@2G6B55 
2B9GD36 
2999D23 
696015 
eBODG1G 


@DBGGH6 
o2B9004 
©0BG6GG2 
eD9DGG2 
0906091 


0993051 


A=75 


0956668 
0944438 
0928769 
0919591 


«889289 
0864716 
0836779 
©895513 
0771929 


6733546 
0693386 
0658963 
0686772 
0561371 


¢515356 
#469342 
0423932 
6379793 
0337174 


0296799 
0258947 
0223899 
0191843 
0162876 


0137813 


- 0114193 


6994292 
eS77136 
#962524 


0G59192 
0039924 
0031461 
0824562 
6f18999 


0214559 
0911055 
#908317 
0026269 
0984585 


#963352 
0062432 
0901748 
09D1246 
eBO988G 


#295616 
0099427 
6999294 
0D9B230 
#94135 


#999991 
@9GG06G 
82B004G6 
#D9BS26 
@DOOG17 


990611 
@ZBDOOT 
0200004 
@8O6GS3 
2BDGGD2 


090001 
©206601 


A=76 


@965949 
0955522 
8942763 
0927359 


6989966 
0887678 
8863950 
0835113 
#893889 


2769497 
6732158 
6692189 
0656886 
0696977 


6568967 
6515255 
0469543 
0424425 
0386464 


6338172 
0297995 
8269298 
8225368 
#193367 


6164422 
6138542 
#115671 
#995691 
0978436 


6963762 
#951259 
0940868 
0632284 
e925268 


0919597 
#815959 
eD11467 
#098653 
2986476 


8BB4794 
0963521 
8962563 
6841849 
#P41322 


0999937 
8969658 
0G0G459 
0090317 
eG98217 


OFODL47 
©FDBH99 
6DAAAEE 
@ODOB44 
©OSG929 


eABHAIO 
8009012 
6OODBH8 
eAGBAAS 
8BAGADS 


8OB9BH2 
©BBGOO1 
®GOOG61 


A=77 


0973477 
6964976 
0954446 
6941493 


6925958 
09867555 


6886685 


0861416 
0833469 


0862289 
97679921 
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0999139 
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e937713 
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©993698 
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«383372 
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0983124 
0977376 
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0879876 
0855549 
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0686522 
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eS5146777 
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o917741 
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0851982 


0824971 
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10995929 
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0273815 
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0076415 
0462816 
0951217 
0341425 
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0349681 
2311853 


0276637 
0242483 
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0891896 
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0090618 
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0556832 
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0159514 
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014274 
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0098557 
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0003748 
0992893 
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APPENDIX 4 


TABLE OF THE BINOMIAL DISTRIBUTION FOR p = 1/10 
This table gives the probability that r or more hits will be obtained in N trials if the probability of a 
hit on any one trial is 1/10. In using the table, we first find the column corresponding to N, and then 
we locate the row corresponding to r (the observed number of bits); at the mtersection is the desired 
probability. 


Interpreting the entry. Probabilities are given to three significant figures. The number from 0 to 10 
which directly follows the three significant figures gives the number of zeros to be placed between the 
decimal] point and the first significant figure. 

Example of use of the table. The entry corresponding to N =480, r =65 is .781—2. This means that 


the probability of getting 65 or more hits in 480 trials with a probability of a hit on one trial equal to 
1/10 is .00781. (If desired one can also interpret the entry as .781107*.) 
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2998 
2998— 
2996— 
0994~ 
2991- 
2987- 
0982~ 
0974— 
0965- 
2952- 
6937- 
0918- 
2895— 
2868- 
¢837~ 


ASASKAGaaessoagaggss 


543 


N=856@ 


0577- 
0521- 
0465—- 
0499~ 
3356— 
03 96- 
0259— 
e217- 
0l79~ 
0146- 
e1L7= 
0926- 
e723- 
0556- 
0422- 
0316- 
0233- 
o1l7G- 
0122- 
2861~ 
°691- 
0414- 
0281- 
0188=- 
0124- 
0819— 
0521- 
0331- 
e207- 
0128- 
o78G— 
0469— 
e279- 
0164—- 
0948— 
0542- 
0396- 
el71- 
0941- 
o512- 
e275— 
0146- 
0 766= 
0397= 
°293- 
0193- 
0515- 
0255— 
0124- 
e661- 
0287— 
0136- 
0633-18 
0292-18 
0133-16 


WWW DMAOODNNVYNMOHMHOWUUUF FRPUWWUUNNNNANEP EPP PRrPEPEAKEHEARAGASE 


N=96608 


2999— 
2999— 
0998— 
2997= 
0996— 
0994— 
2991- 
0987= 
2981- 
0973- 
2963- 
0951- 
0935- 
2916- 
6893- 
«866- 


BHVagas aeaagagggass 


N=957 


0639- 
05 76— 
0529— 
0465~ 
0418- 
e357- 
2398— 
0261- 
e219— 
e181- 
0148- 
o119- 
0945— 
°749— 
257l= 
0435- 
0327- 
0242— 
ol 77- 
0128- 
09D8— 
0637— 
0441- 
e321- 
e2G3— 
0135— 
o883-— 
e571l= 
0365— 
0239- 
0143=- 
o878=— 
0532- 
0319- 
0188- 
e1ll@- 
0634—- 
o361— 
°203- 
ell3~ 
°618— 
0335- 
0179= 
095 D— 
0497= 
o257— 
e131~ 
0663~- 
0331- 
0163- 
0796— 
0384— 
0183= 
0864-19 
0483-19 
«186-12 


OWWDDONNANNVOAMAUUUUF HL PPR WWUWUWNNDNNNNPRP PRP PrP PrP SESSeagaggggcas 


N=06708 


0399— 
2999— 
0998— 
°997— 
2996= 
0993— 
099 G— 
o986~ 
298 9— 
0972= 
«962- 
e95G— 
0934- 
0914- 
e891~ 


SSoseaysageseagagss 


N=8580 


o681— 
0629— 
o575— 
o528= 
0465— 
e411~ 
0359- 
03G9- 
e263- 
e221- 
0183- 
o158= 
e12i- 
0963- 
0756—- 
0586- 
0448— 
2338- 
0252— 
«185— 
0134— 
0955— 
06 73— 
0468= 
o321- 
¢218- 
0145— 
e959— 
0624—- 
o4B1— 
0254- 
0159- 
0985— 
26Z1- 
0363- 
0216= 
o127~ 
e737= 
0423~ 
0240-, 
e134— 
0742- 
0406~ 
0219- 
o117- 
0617- 
0322- 
0166- 
0846- 
0426- 
e212- 
0195~ 
0519— 
0245— 
ell7- 9 
0551-19 
0257-19 
118-19 


OO WDWMDMDONNNTDHOTOWUU YUP PHL PWWUWWWNNNYNNNP PP ee MrPPABESESES Beaune» 


N=9688 


0999— 
2999— 
0998— 
«397~ 
2995—- 
0993—~ 
0998- 
0985- 
0979- 
e971- 
2961- 
0948- 
0932- 
e913- 


SVSeee gas eacasses 


* e728- 


N=0599 


o679- 
©628- 
05 75— 
0520— 
0465— 
o412~ 
0368- 
e3li- 
©265— 
0223- 
0185—{ 
e152—- 
0123- 
°981- 
e773- 
2601- 
0461- 
0349— 
e261— 
0192— 
0149~ 
2182- 
e7il- 
0497- 
0343- 
e233~ 
0157= 
0194~ 
e681- 
044 G— 
e281- 
el77~ 
0110- 
e677- 
e411- 
0246— 
0146~- 
0854— 
0494— 
*282- 
«159— 
e887- 
0489- 
0266- 
01 43— 
0762- 
0491—- 
°269- 
01 67- 
0545~ 
e27T4— 
0136—- 
0670— 
0326- 
0157- 
0746-19 
0351-19 
0164-10 


WOWMOUOUMAOANWNVAMADDUUNUYNE HP PUUKUBUNNNNYNNYPRPERPRPEP PE POEBESESESHESHVAsess 


N=9699 


°999—- 
0999— 
999— 
0998— 
2997 
0995— 
0993- 
0989— 
0985— 
0978— 
e37O~- 
e960—- 
0947- 
0931- 


BEBTHSVHVSPsesggagsss 


R P=1/198 


55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
76 
71 
72 
73 
74 
75 
76 
77 
78 


99 
100 
101 
102 
163 
124 
105 
106 
197 
198 
199 
119 
dll 
112 
113 


38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 
52 


54 
35 
56 
57 


58 


—SEGRET—— 


R 


59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 


73 
74 
75 
76 
77 
78 
79 
8D 
81 
82 
83 
a4 
85 
86 
87 
88 
89 
308 
91 
92 
93 


95 

96 

97 

98 

39 
128 
141 
162 
163 
124 
185 
166 
187 
168 
189 
110 
111 
1212 
113 
114 
115 
116 
Li? 
118 
119 
1268 
121 
122 
123 
124 
125 
126 
127 


46 
47 
48 
49 
58 
51 
52 
53 
54 


56 


N=8608 


05 74— 
0520- 
0466- 
e412— 
e361- 
0312- 
0266- 
0225~ 
elBT- 
01 54~ 
el25- 
0999- 
0790~ 
«616~ 
04T4— 
2360- 
o270- 
e2AR~ 
0146- 
o1f5- 
e749- 
0526=- 
0365- 
0250— 
01l69- 
ell2- 
o740~ 
e481~ 
2389- 
0196~ 
0123- 
0 %66- 
0464— 
2280~ 
ol67- 
2985~ 
0573~ 
o330~ 
o186- 
0195- 
2585~ 
e321- 
0174 
0936- 
6496= 
6260- 
0135- 
e693- 
0351- 
o176- 
o875- 
0429- 
0288- 
el 2A~ 
«476-18 
0224-18 
0164-16 


WOOD ODODNNTANAKHMMFMN PSE PAWWAWNNDNNNNYP PPP Pe Per BasSasaea asad 


N=0780 


0999- 
0999- 
0999~ 
0998~ 
0996- 
0995— 
0992- 
0989—= 
0984— 
0978- 
0969— 


BSOesvrea Sa ssae 


N=9610 


2626- 
0573= 
0529—- 
0466- 
e413- 
0362- 
0313- 
«268- 
0226- 
0189- 
a156- 
0127 
0182- 
0826- 
o631- 
0487- 
e372- 
°280- 
@208- 
@152- 
«119- 
«788= 
0556= 
0387 
«266 
o181- 
e121- 
o823- 
0525= 
0339= 
0216- 
0136- 
«849— 
e522= 
e317- 
«191- 
o113- 
0663- 
o384=- 
2220 
o125- 
0697= 
0386- 
o211- 
a114- 
0611- 
0323- 
0169~ 
0874- 
e44T= 
0226- 
¢113- 
o561- 
0275— 
el33- 
0640-13 
0304-19 
0143-16 


OOD ODD OANANDHAAONMKNNTT PP RR EWWWWUWNNNNYN PRP PPP er SeGassaasass eg sca 


N=O0710 


0999—- 
0999= 
0998— 
6998= 
0996— 
0994- 
0992— 
0988= 
0983- 
o97T= 


ESSassese ags 


N=9620 


o675- 
0625- 
o573- 
e52G= 
2466- 
e414- 
4363- 
0315- 
e270 
0228 
e191- 
#158- 
0129- 
01B3- 
0823- 
0646- 
25 20—- 
0383- 
0289- 
o216- 
0159- 
0115- 
2828— 
0587- 
e4ll- 
o284- 
6194- 
el3l- 
oB7G- 
e572- 
e371- 
0238= 
ei5l- 
e947= 
2586- 
0358- 
e217- 
0129- 
0764— 
0446- 
0257- 
ol4?e~ 
«827- 
2461- 
0254— 
e139- 
alSt— 
0398- 
2218- 
slld- 
2566= 
a289- 
0147T= 
e737- 
0360- 9 
e1l76- 9 
0853-135 
0489-18 
0194-18 


ODDANTINANAHDUTNNNE PRP EUWUUWWYNNNYNNE PE PEP PP SeOSsesSasggggs 


N=0720 


2999= 
2999- 
0998~- 
0997= 
«996— 
0994— 
e991~ 
e988- 
0983- 


SOoqoesoexs8 


N=@632 


«721 
«6 74> 
2624~ 
e572= 
0519~ 
2467- 
0414 
0364" 
0316- 
e271- 
e230 
0193- 
0159 
al3d~ 
01 B5~ 
0839= 
0660~- 
o513= 
0394 
2299 
0224~ 
2165~ 
e121- 
2869~ 
0619~ 
a435~ 
o382~ 
e207~ 
0140~ 
0939~ 
e621- 
0406= 
0262 
e167~- 
0195—- 
065 5— 
0433~- 
0245~ 
0147= 
«876- 
o515- 
2299~. 
0l172- 
«376- 
0548~ 
0304- 
e167- 
0988= 
e48B- 
0259- 
@136- 
e71d- 
0 365=- 
0 186= 
2938~ 
0468= 
e231 
ell3- 
2546-18 
0261-16 
0124-16 


WOOO ODOM IINMMAMAHDUUYNUP PEER WUWWWWNNNYN NNN RP RPP Per PP BASESSsOsSaagdssass 


N=07328 


0999= 
0999— 
0998 
0997— 
0996= 
0994— 
0991- 
o987= 


BSSsucsssgqgs 


N=@640 


«763- 
a7220- 
2673- 
0623- 
e572- 
0519- 
0467- 
e415- 
¢365- 
e317- 
e273- 
e232- 
0195- 
e161 
o132- 
©107- 
0855- 
06 75~ 
526- 
0 405- 
© 308= 
e232- 
elT2~ 
0126- 
e911- 
e651- 
046 0- 
e32i- 
e221- 
0150- 
o191~ 
e673- 
0442— 
«287- 
el84- 
e117- 
9738- 
0452- 
o277— 
6167= 
o180- 
0593— 
0347 
0200- 
o115= 
2649- 
0363- 
e201- 
elld- 
e595- 
0319- 
«169- 
@886- 
0460- 
0236~- 
01l2a- 
0604— 
e301- 
0148~ 
0723-10 
0349-16 
2167-10 


OOODDMDANAYAMDHHKHUUM ER PEP WWWWUNNYNNYNNEPPY PREP PP POSSSHSESASSSBOEGESS 


N=9748 


0999— 
0999~ 
0396— 
0997— 
0996—- 
0993- 
0998—- 


Sseseoeasan 


N=0658 


«801~ 
«761- 
a718- 
«671- 
«622- 
aS71~ 
«5198 
0467- 
0416- 
«366- 
0319- 
e27T4- 
0233- 
«196- 
#163~ 
0134- 
©109- 
e871- 
©689~ 
0539- 
0416~ 
¢318- 
a240- 
0178- 
e131- 
e953- 
26B4~- 
«485~ 
a340- 
6235- 
«161- 
«189- 
e727- 
0480~ 
e31i3- 
a202- 
e129- 
#811- 
0565— 
e311- 
0190- 
#114- 
e679- 
2400~ 
0235- 
0134- 
» 7T64- 
0430- 
0240~ 
01327 
o722- 
0390- 
0268- 
e11¢- 
05 76- 
¢298~ 
o153< 
e7T4~ 
0 389- 
0193- 
0956-10 
0463-18 
0225-19 
0197-12 


OOO MDMODAANARDOOMNHNMP ES PUN WUUYNYNYNNAKHEP RPP eR PY OOSSSsesaogeg ss sagas as 


N=0750 


0999- 
0999- 
0999- 
2998— 
0997~ 
0995- 
0993~- 


Sse qggag 


o44 


N=0668 


0835- 
0799- 
«760- 
o716— 
e670- 
2621- 
o571> 
0519- 
e467- 
o416= 
0367 
0320- 
e276- 
0235- 
0198- 
0165- 
e136- 
0110- 
0887- 
o7b4— 
e552- 
0428- 
e327- 
0248- 
0185- 
e137- 
0997 
o718- 
0512- 
0360- 
0250- 
el?2- 
ell7- 
0785= 
e521- 
0341- 
e221- 
e142- 
e899—- 
0563- 
0349— 
0214- 
0132- 
oT?6- 
«460- 
e270- 
0156- 
0896- 
0588- 
0285- 
01 58- 
e871- 
0474— 
0255— 
o136-~ 
0716- 
e373- 
o193- 
0986- 
0499- 
0250= 
0124- 
0609-10 
4296-10 
0143-108 


COOORMMODAYANAHTDHNMUME EEE PUWUWUNNNNNN NYE Peer Pee PSSSSese#qgssasedssoeon 


N20760 


0999- 
2999~- 
«999~ 
0998 
0997- 
0995~ 


Seaecog 


N=@6708 


o864- 
0833- 
s797- 
0758- 
e715- 
2669- 
°629- 
05 70— 
0519= 
2468- 
e417- 
«368- 
e321- 
e277- 
0237- 
0280- 
0167- 
0137- 
e112- 
2902— 
o718= 
°565—= 
0439- 
0337- 
0256- 
0192- 
0142- 
0184- 
o753— 
°538- 
°381- 
o266—- 
0184- 
e125= 
0845— 
0563- 
0371- 
0242= 
0156- 
0994—- 
0626- 
0390- 
0240- 
0147- 
0883- 
052TH 
e3il- 
e181- 
0195- 
°59B- 
0338- 
21 89=- 
o185- 
o573— 
e3il- 
2167 
°885- 
0465—- 
0242- 
0125- 
0637- 
0322~ 
o161- 
2197-10 
0391-108 
«190-16 


OOO SODDMDANNNDMDOKNMNL TNE EEE WOW WUWNRNNNN PPR Pee PP RrPOEASHSSSSESSSSGHSSESSSSE BSE 


N=0770 


0999~ 
0999— 
0998— 
2998- 
0996- 


SSesescs 


N=®680 


°889- 
2862- 
e831- 
0 796- 
«756= 
0714— 
0668- 
«619- 
a5 7D 
0519- 
0468- 
0418- 
0369 
e322- 
0279- 
0238- 
2201- 
0168- 
0139~ 
o1l4- 
0918- 
e732- 
05 78- 
0450— 
2347- 
0264- 
0199- 
0148- 
01 09- 
0788= 
0566- 
0482- 
0282- 
0195- 
0134- 
0998- 
«628- 
0493- 
0264- 
el7l- 
elld- 
0694— 
0435- 
©269- 
©165- 
e999- 
2598- 
0354— 
206~ 
0119 
2668- 
0367- 
0193- 
0934- 
2689- 
03 76- 
e223- 
0109- 
e57T- 
0382- 
0157- 
e827— 
e411l- 
e20T- 
0103- 
0512-12 
0251-18 
el22-12 


OOOWODODDNNNNNOAHTUUNUUUE EEE WUWWHWUWNNNANNY EY Pe PP Perr Pr BSSSSESSHESSSEESEESSESTSOS 


N20780 


2999- 6 
«999- 2 
2998- @ 
2997= 2 


N=2699 


e9)1- 
2885 
2860- 
«829- 
0794- 
07 55- 
e?l2- 
0667~ 
0619- 
2569- 
0519- 
0468- 
0418- 
03 78- 
0324- 
0280- 
0240- 
#2Q3- 
0170~ 
e141- 
0115 
6933~ 
0746- 
0590- 
°461- 
0356- 
e272- 
02Q5- 
0153- 
o113- 
0824~- 
05 Qe— 
2423- 
0298= 
2208- 
o145- 
0974- 
©655— 
e436- 
0287 
0187- 
0128- 
o767= 
6483- 
e381- 
0186- 
e1l13- 
0684- 
0408— 
e241- 
e1l41l- 
e817- 
«468- 
2265- 
0149- 
0826- 
0454- 
02467- 
0133- 
e7ll- 
0375- 
0196- 
0192- 
0522- 
«265- 
0133- 
0665-108 
2328-10 
#16i-18 


WDOODDDGANIVNAHOKRNUMU LSE EEA WUWWUN NNN NE eR PP er Perr SESSA SHSSAHESSSESESESSVVOCSES 


N=0799 


0999- @ 
0999- @ 
0998- @ 


167 
108 
169 
1190 
111 
112 
113 
114 
115 
116 
117 
118 
119 
1208 
121 
122 
123 
124 
125 
126 
127 


46 
47 
48 
49 
50 


52 
53 
54 
35 
56 


P=1/16 


117 
118 
119 
120 
121 
122 
123 
124 
125 
126 
127 
128 
129 
139 
131 
132 
133 
134 
135 
136 
137 
138 


N=070 


0959— 
0945— 
0929— 
09B9— 
0886— 
0859— 
0827 
6792— 
o753— 
e711- 
0665—- 
e618- 
2569— 
0518- 
0468= 
0419— 
o371- 
0325— 
e282— 
e241— 
o205— 
el72~ 
0143- 
o1llT= 
0948~ 
o761- 
0693- 
0473- 
0366= 
o285— 
e21l2- 
0159- 
e118- 
0861- 
0623- 
446~ 
e315- 
022G— 
ei52- 
0194- 
0785— 
0472~ 
0312- 
0284— 
0132- 
0846— 
0536- 
0336- 
0268= 
0128- 
e775= 
0466= 
e2tT= 
0163— 
0949— 
o547— 
e312- 
o176- 
0985— 
0545—= 
6299~ 
016 2— 
e871- 
0464—- 
0244- 
0128- 
0659— 
0337 
el71l- 
0859-108 
0428-16 
o211-16 
0183-16 


WOODW DMDMODONWATHAHADMNUUNUN PP EP PWHUUWUNNNNYNYNNPYEPPrPRPHEHEPEPSASEERSANBASHKAABSSVsaasags 


N=$7196 


«968- 
«958— 
0944— 
0928- 
0908- 
0884— 
0857= 
0826— 
279G- 
e752= 
2789- 
2664— 
e617—- 
0568— 
0518- 
0468- 
0419- 
e372- 
2326- 
2283- 
e243- 
«266- 
0173- 
0144- 
0119- 
0963- 
oT74- 
«616- 
0484- 
0376- 
«289- 
2219- 
2165— 
0122- 
2898- 
0652- 
0468- 
0333- 
0234- 
«162- 
elll- 
e757- 
0589 
s338- 
0222= 
o145- 
0931- 
0593~ 
0373— 
0233- 
0144- 
0876~ 
0538- 
0317- 
0187- 
elld—- 
0637- 
«366- 
0208= 
0117- 
0652= 
0369— 
«197= 
0106- 
057D= 
0362- 
0159= 
0827- 
0427— 
0218= 
o110- 
0553-16 
0275-18 
@135-16 


OOOODDONNNADKHODUMYOUMP PPP RUWUODNNNNNNNEP PPP Per ADQRARASAGKASSAAWSSASaAasagasgggas 
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0356-16 
e177-16 


N=G736 


0982- 
0975— 
«966~- 
0955—- 
0941~ 
0925- 
«905—= 
«881= 
0853- 
e822- 
o787— 
o748~— 
e7BT- 
0662- 
*615— 
o567- 
o518- 
2469- 
0420- 
o373- 
e328= 
o286- 
0246- 
0210- 
o17T~ 
0l47— 
0122- 
0993— 
0802— 
0641- 
#526—- 
0395— 
e305= 
e233- 
01l76— 
oi32- 
e975—- 
eTlL3- 
e516- 
0369— 
e261- 
0183- 
e127- 
«368 
e589— 
6395- 
6262- 
elT2- 
0112= 
e719— 
0458— 
2288— 
0188 
elll- 
0678— 
0410- 
«246— 
0146- 
0855— 
0497— 
o286=- 
0163- 
092G— 
o514— 
e285— 
0156= 
0847- 
0456— 
0243- 
0128- 
e671— 
0348— 
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OOOO DOS MOY VODA AR MW SL HP EWU WWEWUNNY NN YN NYY 


N=1980 


0399~ 
0399— 
2999~ 
e99B- 
0997- 
0996~ 
0995—- 
0993~ 
s99i- 
0987- 
0983- 
0978- 
0972~ 
0965- 
0955— 
0945= 
e9352~ 
e917~ 
2899- 
0879- 
e857- 
0832- 
0825- 
e775—- 


SAeOEsSSsSseSSSaAsSsSVBBEPesessesss 


N=0999 R 
#168 1 120 
el31- 1 121 
e1@l- 1 122 
e769= 2 123 
0582- 2 124 
e437— 2 125 
0326- 2 126 
e241- 2 127 
e176 2 128 
0128 2 129 
e923- 3 130 
6660- 3 131 
0468= 3 132 
0329- 3 133 
0230— 3 134 
e159= 3 135 
0199- 3 136 
eT43- 4 137 
0502— 4 138 
0337- 4 139 
0224- 4 146 
0148- 4 141 
e967= 5 142 
2628 5 143 
0405= 5 144 
e259= 5 145 
e0164= 5 146 
e1@3~ 5 147 
0647~ 6 148 
e4B1l= 6 149 
0247 6 152 
ei5i- 6 151 
o915- 7 152 
0558- 7 153 
0329~ 7 154 
0195~ 7 155 
e115- 7 156 
e670- 8 157 
e389- 8 158 
«224~ 8 159 
e128 8 169 
0726~ 3 161 
2489- 9 162 
©229- 9 163 
0127- 9 164 


e701-19 165 
«384-19 166 
269-10 167 


113-10 168 
N=1096 R 

71 

72 

73 

74 

75 

76 

TT 

78 

«999- @ 79 
0999- @ 8% 
e999- 9 8) 
0998- B 82 
0997= 83 
2996- @ 84 
0995- @ 85 
2993- @ 86 
0990- @ 87 
o987- @ 88 
0983- @ 89 
0978 B@ 90 
e972~ 2 91 
0964— 2 92 
0955- B 93 
0944—~ 9 94 
e93l- 0 35 
e916- @ 96 
e898- 9 97 
e878- 0 98 
0856- 9 99 
e831- 2 100 
e824- 2 101 


P=1/18 


R 


182 
143 
104 
185 
196 
107 
168 
149 
1298 
1121 
112 
113 
114 
115 
116 
117 
118 
119 
129 
lal 
122 
123 
124 
125 
126 
127 
128 
129 
130 
131 
132 
133 
134 
135 
136 
137 
138 
139 
149 
141 
142 
143 
144 
145 
146 
147 
148 
149 
150 
151 
152 
153 
154 
155 
156 
157 
158 
159 
1602 
162 
162 
163 
164 
165 
166 
167 
168 
169 
179 
171 
172 
173 
174 
175 
176 
177 
178 
179 
188 
181 


N=100@ 


0432- 
0391—- 
0352— 
0314- 
e278- 
o24han 
e213— 
el 84—- 
0158- 
e1355— 
o114- 
0954— 
e793— 
0654— 
0535—={ 
0434— 
2349— 
0278- 
0228- 
o1l73- 
eil34—- 
01 B4- 
e793— 
0602— 
0453- 
0©338- 
e251 
0184= 
o134- 
097G— 
0695— 
0494— 
0349— 
0244— 
0169- 
oll 7?- 
0797- 
0540— 
0363- 
0242- 
o16G- 
01 Q5— 
0687—~ 
0445—~ 
0285— 
0182~ 
0115- 
o721~ 
0449—~ 
e2tt~ 
ei7d~ 
01d4~ 
0626~ 
e376~ 
e224~ 
o132— 
o7T6~ 
0452~ 
6261~ 
2156~ 
0855~ 
0484~ 
e272 
0152- 
0841~16 
0463-19 
0253~16 
0137-18 


WOOWOMOAGDAANNHAAMGDAADUNUVNMKMUP PLP EPUWAUWWWWNYNYNNNNN EYP PR PE e PPP OSaaasaagas 


N=1910 


04 T4— 
0432- 
0392- 
0352- 
e315- 
0279- 
0245- 
e2t4~ 
0186- 
0159= 
0136- 
ell 5- 
0965=— 
0883— 
«663— 
0543- 
re 
0355- 
0284- 
0225~ 
e177 
#138- 
0167- 
0818- 
0622- 
047 B— 
0352- 
0261- 
0192- 
0148— 
o162- 
e731- 
052i- 
0369~ 
e259- 
218G— 
o124— 
0853- 
o580— 
0392- 
0262- 
ei74— 
e115- 
«751= 
0487- 
0314- 
0201- 
o127- 
0862- 
e591- 
e311- 
0192- 
all? 
e7il- 
0428- 
e256- 
o152- 
0895- 
0524- 
0364— 
0175- 
013B- 
e571- 
0322- 
e18i- 
e1gi- 
0556-16 
0305-18 
0167-16 


OOOVMORSOMMOANSIMOHMOHHUVUUUMUHLHEH PE PUUUUHUWANNNNYNNNHP EP RP PY Re Ye PPP BAT SEsaasagan 


N=1920 


sS515— 
s4T4- 
6432- 
0392- 
0353— 
o315- 
4Z289- 
0246- 
a215— 
0187- 
e161~ 
e137- 
e116- 
0975— 
o813— 
2672— 
a551= 
0448— 
0362— 
2290— 
0230- 
ol8i- 
0142- 
o116—- 
0843- 
0643- 
3486— 
03565- 
e271- 
0290- 
o147- 
e1fT~ 
0 769- 
0556— 
239G- 
e274~ 
0192- 
o133- 
e913- 
0623- 
0421- 
0283- 
0189- 
e125- 
0819— 
o534— 
0345= 
e221- 
e141- 
0891- 
0559 
0348— 
a215- 
o132- 
2895— 
e487- 
0292- 
ol 7T4— 
o163- 
2606— 
0353— 
2225- 
o118- 
0672- 
e381- 
e215- 
0129- 
0667-1 
0368-19 
0201-168 
0116-19 


ODDO DMD DOIVANNTANDHDHAAHDMUNUUL DPE PEUWWUWUNYNNNNYNNEPE PE PP eRe PP ROABHEAAGCAASABRS 


N=193@6 


«557~ 
o515~ 
047 4e 
0433~ 
0393~ 
o354~ 
o316~- 
o281— 
@247~ 
e216~ 
o188~ 
o162= 
2138~ 
e117= 
©986— 
03823~ 
o681- 
0569- 
0456 
0369— 
0296- 
0235- 
a186- 
0145- 
e1l3- 
2869- 
2664— 
05 83—- 
e378- 
e282- 
4209— 
0153- 
ell2- 
«837— 
a579- 
0412- 
e291—- 
0203— 
elGl~ 
0975— 
2667- 
0453- 
03B5— 
a204— 
2135- 
0892— 
o583— 
e379- 
0244— 
o156- 
«988— 
0622- 
0389— 
e241— 
0149— 
o910— 
0552— 
e333— 
6199- 
o118— 
2699— 
04D9— 
0238- 
o138— 
2789— 
0449— 
0254- 
0143- 
e797 1G 
0442-19 
0243-16 
0133-16 


OOUWO ODDO ONNNNVNDHHARNUW UN UHH HRP PWUWWUWANNNYNNNNNP PY Pe PR PPP HY SOBSVagsagagaeas 





N=1049 


0597= 
0556— 
oS15- 
0474 
0433- 
0393— 
0354—- 
6317~ 
0282= 
2248—~ 
e217- 
6189= 
0163~ 
0139- 
0118~ 
0996— 
0833~ 
0699~ 
0568— 
2464~ 
e375— 
0301i~ 
024G—~ 
2198~ 
2149- 
«116~ 
0894~ 
2685~ 
0525~ 
2392+ 
0293-~ 
e217~ 
216¢~ 
e1l7~ 
0847~- 
0629~ 
0434— 
2307- 
e216- 
0156- 
0194~- 
e7i4- 
0486~- 
4329— 
e221~ 
0147~ 
0975— 
0636- 
e414— 
«268= 
0172- 
4189- 
«691— 
eh 34n 
0273— 
0l67= 
0193- 
«626- 
0378 
e227— 
0136- 
o854— 
o4T3~ 
«276- 
«16G- 
0923— 
e528~ 
0320—~ 
3169- 
0949-198 
2528-19 
0292-16 
2166-16 


WOOO ODMDODDANNYANAHDHADHDNUMUUNU FH HE HSRUUNUUUWUUNNNNNNNNKPP PRP PRP P PP HE OSEORSHEESegaesagrs 


N=1056 


0636- @ 
0596— 
a556= 
0515- 
047T4- 
0435- 
0394— 
«355- 
2318- 
a283—- 
2249- 
2219- 
0198— 
0 164—- 
e146- 
«2119- 
e1f1- 
0843- 
e7B9—- 
o576=- 
e471- 
0382- 
0387- 
0245= 
0194- 
e153- 
2l19- 
°928- 
°706- 
0538- 
0496- 
0304— 
0226- 
2167- 
0122- 
2888~— 
2640- 
0458~ 
2325~ 
0229~ 
o16d- 
elli~ 
2 764~ 
@522~ 
e354~ 
0238~ 
0159~ 
0185~ 
0694~ 
0453~- 
0294~— 
«189~ 
0121- 
2767 
0483— 
2382— 
e187~ 
o116~ 
«76~ 
a429=— 
0259— 
2155- 
e923— 
0545- 
e320- 
0186- 
01@8- 
2629- 
03535- 
o290- 
e113- 
0630-19 
0356-10 
0193-16 
«186-16 


OOOO DMDMOHDODANNVVAAAHAMHODHMHMUUNUF PRE HHSWUUWWUWNNNNNNNN PRP PP Pree PR ORASAKEASEBASSSS 


549 


N=166@ 


26 74— 
2635- 
0596= 
0556—- 
o515— 
04 74— 
0434- 
0394— 
0356- 
0319= 
o284—- 
o258- 
022G— 
e1lSi- 
el65— 
el42- 
0122— 
0192- 
0852- 
©709— 
0585- 
e4T9= 
2389- 
0313- 
0253- 
0199- 
o156- 
2122- 
0947= 
o%28- 
0555— 
2420- 
0316- 
0235- 
o174—- 
21l28- 
093G- 
o872- 
0482- 
0343- 
0242= 
ol 7G- 
0118- 
e815— 
2559- 
0380- 
0257- 
0l72~ 
ell4a- 
0755~ 
3495~ 
0322~ 
0268— 
0133~ 
0848~ 
0536~ 
0336- 
0210- 
e136- 
0797— 
0486-~- 
0294— 
elT7~ 
o1S6~ 
2627~ 
03569~ 
0216- 
0125— 
0724~ 
e415— 
0236- 
e134~- 
o75G~-16 
0418-18 
0232-19 
0128-10 


WOOO MOO MDONANSNDORAHUMOKUUE ELSE PPWWWWUUWUNNNNNDNNNP EPP rere Pe BOSBasSVeRsasssgaagggess 


N=1070 


e7B9— 
2673- 
*635— 
°596— 
0555— 
o515- 
o474— 
0434= 
0395— 
2#356=— 
03198 
o284- 
e251- 
e221= 
0192— 
°166- 
0143< 
0122- 
e193- 
2862 
0718= 
0593— 
0486— 
0395— 
0319~ 
0256- 
0233— 
0168—- 
0125= 
097 3~ 
o75G— 
0573— 
0435- 
0327 
2245— 
°181~ 
0133- 
2974— 
o795— 
e5O7- 
0362- 
©256~ 
ol BS~ 
0126- 
o87D— 
0598= 
°4B8— 
«276- 
0186- 
0124—- 
«820— 
2539— 
0352= 
0228- 
0l47~ 
0938— 
0595— 
o3T4— 
o234— 
0145— 
0896— 
0549— 
0334— 
e201= 
e1l2i- 
0719= 
0425= 
0250— 
0146- 
2844— 
o486= 
0278— 
0158= 
«899-16 
2498~18 
0277-108 
e153~198 


DOD ODHMDDAINNNDMOOOOUUUNUUEP REP PPUDGWUUUWUNNYNNNNNANY PEPPY PP PP PASABASSASSSAsSaggags 


N=108 


0743~ 
0748~ 
e672= 
e634- 
0595- 
0555— 
o515— 
64 74—- 
0434- 
e395- 
0357~ 
0320— 
0285—- 
e252= 
0222 
0193- 
2167— 
0144— 
e123- 
0194- 
e872— 
et2T- 
e601i- 
0494— 
0402- 
0325— 
s261- 
0208- 
0l64— 
0129- 
2198- 
e772- 
0592— 
0450—- 
0339- 
0254- 
#189~ 
0139- 
o1G2- 
0 74G- 
0533- 
0381~ 
e271- 
«i91- 
0133- 
0927 
0639— 
0437— 
e297— 
e298- 
6134= 
e898— 
0587— 
o3B4— 
025G— 
0161- 
01 f3- 
0658— 
0416- 
e261- 
0163- 
o191- 
0619—- 
e377 
e229- 
#138— 
2823- 
0489- 
0288- 
o169- 
e982- 
0568= 
e326=- 
0186- 
0195— 
0592-10 
0331-10 
0184-18 
0191-18 


WOWOWOO MOMANIYAVHAHOODUUNUUNUPH PEPE PWUWWUUNNNNNNNNP RPP PrP PY Pe PPA SHAEBHAHESEESEREGSERASSAS 


N=1899 


o7t4~ 
0742~ 
e78t~ 
s671-~- 
2634— 
0595~ 
0555— 
e515- 
6475— 
o435~— 
0396- 
2358— 
s321~ 
«286 
0253~ 
e223~ 
2194- 
01638- 
01l45— 
0124- 
0185— 
s881- 
0736 
2669— 
o581- 
0439— 
e331 
«266— 
e212- 
0168- 
e132- 
6103- 
0795- 
2619—- 
©465- 
e35i- 
0264- 
0196—- 
0145— 
o106~ 
eT75— 
©560- 
0482- 
0286- 
o202~ 
0142— 
098 7— 
0682- 
0468— 
o319— 
0216— 
0145~ 
0964—= 
2638— 
0419— 
e273- 
ol7?—- 
e114— 
0728- 
°461~ 
e291— 
0182- 
o113- 
0696— 
0426— 
0259=- 
0157— 
eF4 Qu 
0568—- 
0332- 
0195— 
e114- 
°661— 
0381— 
#218- 
e124—~ 
o7G2-19 
0394-19 
#220-18 
0122-10 


OOOWMDMDMODNTSNANADTOTHMUNNTUUN FER PS PWUUWUUNNNNNNANEP KE RPE RRP PPR aASEESESSEEHHSASASSOSSS 


R Px1/19 


102 
123 
184 
105 
196 
187 
128 
129 
118 
111 
112 
113 
114 
115 
116 
117 
118 
119 
120 
121 
122 
123 
124 
125 
126 
127 
128 
129 
136 
131 
132 
133 
134 
135 
136 
137 
138 


—SEGRET— 


109 
118 
111 
112 
113 
114 
115 
116 
117 
118 
119 
120 
121 
122 
123 
124 
125 
126 
127 
128 
129 
136 
131 
132 
133 
134 
135 
136 
137 
138 
139 
148 
141 
142 
143 
144 
145 
146 
147 
148 
149 
158 
151 
152 
153 
154 
155 
156 
157 
158 
159 
1698 
161 
162 
163 


N=1180 


0999— 
2999— 
0999— 
03999- 
0998— 
0997— 
2996— 
099be 
0992= 
0998~ 
0987- 
0982= 
2977= 
0971— 
e963- 
0954— 
0943- 
0930— 
o9l4~ 
«897— 
e877 
2855— 
0B30- 
0823- 
e7T3- 
e741- 
e767 
e671=- 
0633- 
0594— 
0555- 
0515- 
0475= 
0435— 
0396= 
0358— 
0322- 
e287 
0254- 
0224= 
0195— 
0169= 
0146- 
0125- 
0126- 
2891- 
oThhn 
0618- 
05 28—= 
0415= 
0337- 
e271= 
e217- 
e172- 
o1l35— 
0186- 
0818— 
0629- 
0488— 
0364— 
e27T3= 
o2Aam 
e151- 
elll- 
o811- 
0588= 
0423 
o382- 
a214- 
0158- 
01 85- 
e727 
0500— 
0342- 
0232- 
01 56- 
0104= 
2693- 
0457 
a299= 
0194- 
0125= 
e833— 
e511- 
0323- 


HROTOMUMMMMLS FREE EUWWWWHWNNNYNNNNN YP Pee PP eer PP RBAAAGSHSHBRADANSASASVSPSSSSSIVVWSSVSFSSESESESASOSESESRVBASGSUPSBVWSNASS 


N=1110 


2999- 
0999- 
2999- 
0998- 
2998- 
«997> 
«996- 
0994— 
0992- 
0998—- 
0986- 
0982— 
097TT> 
097— 
0963= 
0953- 
0942= 
«929- 
0913- 
«896- 
e876—- 
0854—- 
2829- 
e801- 
e772 
07T40~ 
0 726= 
0670 
«632- 
0594- 
255m 
0515— 
0475— 
e435— 
0396= 
2359- 
0322- 
0288= 
0255= 
0225- 
0196- 
e171- 
0147= 
e126- 
6197- 
2980— 
e753- 
2626- 
«516- 
0422= 
0343- 
e276=— 
e221- 
o176- 
0138- 
«1¢8- 
0841- 
0648- 
0496—- 
o376- 
0284— 
e21l2- 
0157- 
o116- 
0849— 
2616— 
0444- 
0318- 
0226- 
0159- 
elll« 
eT 75— 
0534- 
© 366- 
0249~ 
0168= 
e113- 
0751- 
0497- 
0326- 
e213- 
o138- 
0884- 
0 565— 


DHMMRNMMNMN FE EEE PUWWWNH RW WNNNNNNNNP PP Pe PPP ree BARSSHAGDAHSASSSAKSASSASHAASSSSSSASSRASSPSAASSAPSAVaAgagasgag 


N=1120 


0999~ 
0999— 
0999- 
2998- 
0998— 
2997- 
2996= 
0994— 
0992= 
0989=— 
0986—- 
0982- 
0976- 
0970— 
0962- 
0952= 
0941- 
0928- 
0913- 
0895= 
o875= 
0853- 
«828- 
0820- 
e771= 
0739= 
0705- 
0669- 
0632= 
0593- 
0554—- 
0515— 
0475— 
0436= 
0397= 
0359- 
0323- 
0289- 
0256 
0226- 
0198- 
0172- 
0148- 
0127- 
0108— 
0910= 
2 762- 
0634- 
2523- 
0429— 
0349- 
0282- 
0226- 
0180- 
0142 
elll- 
0B64- 
066 7= 
e511= 
0389- 
0294- 
0220= 
0164- 
#121- 
0887— 
0646- 
0467- 
0335- 
0238- 
0169- 
o118- 
0824— 
3570- 
6392- 
0267— 
el8il- 
«122- 
0813- 
6539- 
0355- 
6232- 
e151- 
e973- 


DOTMMUP EEE RWWWWWNW NNN NYNNNN RP PP Pe PP eee rPOASBSSSASSHSRASSSVGVVPSSSVSBVBSSBSOSPSVCSESHPSSPSNVSPSEASSESASess 





N=11306 


6999- 
2999— 
2999- 
2998- 
«998- 
0997= 
0995= 
a994— 
e992- 
0989-~ 
0986— 
2981- 
0976- 
0969- 
0961- 
0952= 
0940- 
0927= 
e912- 
0894— 
08 74— 
0851= 
0827- 
2799— 
e770- 
0738— 
eTO4— 
«668— 
e631- 
0593- 
a5 54— 
0515=— 
0475= 
0436= 
0397- 
0360- 
0324- 
02990- 
0257= 
0227 
2199- 
e17?3- 
0149~ 
«128= 
0109= 
0919— 
e771- 
0642 
e531- 
0436= 
0355— 
e287= 
4230- 
0184- 
e145- 
«1l1l4- 
0888— 
0687= 
0527= 
0402= 
«304— 
0229= 
0170- 
0126= 
e927= 
0676- 
0490- 
0352= 
e251- 
0178- 
0125- 
0876- 
2608— 
0419= 
e287- 
0195= 
el31- 
0879~ 
0585— 
0 386- 
0254= 
0165- 


WOUUMN EL FS EEL PWWUBWWUNNNYNNNNNYE EPP Pee PPP OSCKRSHSHHKASHSSSCHSSSSBSBVASSUsSs#hssSlSVSBVAVs#sB He HV goesasgsg0gqag 


N=1140 


2999- 
2999- 
2999- 
«998- 
2998- 
0997- 
0995—~ 
2994— 
e991- 
2989- 
0985- 
0981~ 
0975- 
2969- 
2960— 
e951- 
0939- 
0926= 
6911- 
0893—- 
e873- 
«850- 
0825~ 
0798— 
0769- 
0737- 
e723—- 
«668- 
2631- 
0593- 
0554— 
0514—- 
0475= 
0436=- 
0398~ 
0361- 
0325- 
02990- 
0258- 
e228= 
@290- 
01 74= 
0150- 
e129- 
110- 
«929- 
0780- 
0650— 
0538- 
0442— 
o361l- 
0292— 
0235- 
0187- 
0149~ 
ell?- 
0912= 
0707= 
0544— 
e415= 
o315— 
e237- 
0177- 
e131- 
2968- 
«708- 
0514- 
a370- 
«265- 
0188= 
e1l33- 
e93l- 
0648- 
0447- 
e307- 
0269- 
ei4l- 
0958- 
0634— 
0428- 
«276- 


WUU UE LHP SUWWWWNWUDNNYNNNNNP RP PP PREP PPP SAKSSS&SosH gag SF{SVoseel SSs9HSeqosisSoeo ss VqgusSH SSH gssga ssgaggqggy 


N=1150 


0999— 
0999— 
2999- 
2998— 
0997- 
0996- 
0995- 
0993— 
e991- 
2988— 
0985— 
«980— 
0975— 
0968— 
0968- 
0953— 
2939— 
0925— 
091d— 
0892— 
0872— 
2849= 
0824~ 
e797— 
«768= 
0736- 
0782= 
0667= 
2630- 
0592— 
0554— 
e514—- 
0475— 
0436= 
0398- 
0361- 
0325= 
e291— 
0259— 
0229- 
e28l— 
o175- 
o151= 
013d— 
elll- 
0938— 
0789=- 
©658- 
0546- 
0449- 
0367 
0297- 
0240— 
0191- 
0152- 
0120- 
#936— 
e727- 
0560— 
0429— 
0326- 
e246- 
0184- 
0137- 
e1d1- 
0740— 
a538- 
0389- 
e279- 
a199- 
e141- 
2988— 
2689- 
0477- 
0328- 
0224- 
@152- 
e192- 
2686- 
0456= 


990 


WUE PELE PRE UWWDHWUDNNNNNYNNNYNP PP Pe PrP ee PrP BOSAHKHGSASHKSHS§SKGH AV HS GSGF ESS SGVFaesseSRVsVse FSA SVzyugusaesssecs 


N=1160 


2999— 
03999- 
2999— 
0998— 
0997- 
0996- 
0995— 
6993- 
099]- 
0988—= 
0984— 
098D— 
0974—- 
0967= 
2959= 
0949=— 
0938— 
0924— 
0909=— 
2891- 
o871i- 
0848— 
0823- 
0796- 
07T67= 
0735- 
0782- 
0666- 
0630- 
0592— 
0553- 
0514=- 
04T5= 
0437- 
0399—- 
0362= 
0326- 
0292= 
0260~- 
0230- 
2202- 
o176- 
o152- 
e131- 
e112- 
0947— 
0797 
0666~ 
0553- 
0456- 
0373- 
0303- 
0244= 
0195- 
o155— 
e123- 
0960- 
o747- 
0576— 
0442— 
0336- 
0254~ 
0199= 
0142- 
0195- 
0773- 
0564= 
0408- 
0294— 
0219- 
0149= 
0105- 
o732- 
0589— 
0351- 
0240- 
0163- 
o11d- 
o741- 


MP PPPS EWU WWW YNNNY NNN PE Pe ee Pe PPP HQOOSKSSSSssgeSSVANQ Vga ggsV@ eggs SSS SVS Ol VFSRsSVSBVaA se Sse sseqosessesos 


N=11708 


2999— 
2999- 
0999— 
«998- 
0997- 
0996- 
0995— 
2993- 
e991— 
0988- 
0984- 
0979- 
0974= 
2967= 
0958=— 
2948=- 
0937- 
0923- 
2938- 
2898— 
o878- 
0847=- 
°822- 
0795- 
°766- 
0734- 
e701=- 
2666- 
2629= 
0591- 
0553- 
0514- 
o475— 
0437- 
0399= 
0362- 
0327- 
e293— 
0261- 
0231- 
2203- 
ol77- 
0153~- 
e132- 
ell3- 
0956=- 
o826=- 
0674= 
0560— 
2462- 
0379- 
o328- 
0249— 
0199- 
0159— 
0126- 
0985= 
°767- 
0594~ 
0456- 
0348= 
o263- 
0198- 
0148- 
«110- 
2887- 
2590- 
0428=— 
0309= 
e221- 
0157= 
elll- 
e778= 
e541- 
e374- 
e257- 
el 75= 
0119- 


PRP PEWWHWWUWHNNNYNNN NNN RPE Pe Pee eee BSSESCAKVASHSSHSVSHSESASSHSSSSEVe@ Sass sgesf OousSo4ag Oyu Vlssve gg cseo 


N=1180 


0999- 
0999= 
0999— 
2998- 
6997- 
0996- 
0995- 
0993- 
0990— 
o987— 
0984- 
09T9= 
0973- 
0966= 
0958—- 
0948— 
0936= 
0922~ 
o9B7—- 
«889- 
0869- 
0846- 
e821- 
07 94— 
0765— 
e733- 
0700— 
e665- 
0629~ 
0591 
0553- 
0514— 
0476— 
0437- 
0480— 
0363- 
0328- 
0294—- 
e262- 
e232- 
0204— 
0178- 
0154 
0133- 
0114- 
0967= 
0816- 
0684—- 
0569=- 
0470=— 
0386- 
o315— 
0253- 
0204- 
0162- 
o128- 
el9l- 
0788— 
e611- 
0470- 
0359- 
e273—- 
0205— 
0154- 
0114- 
0842- 
0617- 
0449= 
0324- 
0233- 
166- 
e1l7- 
0825— 
0576= 
2399~ 
e275- 
0188- 


PHP EFUWUUHUWUWUUNDNNANNNNP PP Pe ee PP re PRP ROAOKHKASSSKSHKHASEASHSHSHSKSHSESESHSHHSSHEHOHSHSSSEESSSHESASLHEHHCHSSES 


N=1190 


2999—- 
2999— 
2999- 
0998- 
0998— 
0397 
03996- 
0994— 
0993- 
0990— 
e987- 
2983- 
0978=- 
0973- 
0965— 
0957 
0947= 
0935- 
o921- 
0906— 
2888— 
o867- 
0845—- 
0820- 
0793= 
0764- 
o732= 
0699— 
0664— 
0626— 
°591= 
0553—- 
0514= 
0476- 
043TH 
0400- 
0363- 
0328= 
0294—- 
0262- 
o232= 
0205— 
0179= 
0155= 
0134- 
e115= 
0975— 
0823—= 
0690—- 
05T5=— 
0476=- 
e391- 
0319= 
0258= 
2208- 
0166- 
el3i- 
0184- 
oBO9~ 
0628- 
0485—= 
e371- 
0282- 
e213- 
o162- 
0119- 
oB78- 
0645— 
0470— 
0341- 
0245- 
0175- 
o124- 
«874- 
e612- 
0425— 
0294— 


PEP EPUWUUUWWWUNNYNDNNNNNP PPP Pe ree Per BASHKHHASCSSSASSSESSHS SSS SS&GEPLPUsP4#qgoga Ses ass seH Fag seu og» sc 


116 


119 
120 
121 
122 
123 
124 
125 
126 
127 
128 
129 
130 
131 
132 
133 
134 
135 
136 
137 
138 
139 
140 
141 
142 
143 
144 
145 
146 
147 
148 
149 
158 
151 
152 
153 
154 
155 
156 
157 
158 
159 
160 
161 
162 
163 


P=1/106 


R 


164 
165 
166 
167 
168 
169 
176 
171 
172 
173 
174 
175 
176 
177 
178 
179 
186 
181 
182 
183 
184 
185 
186 
187 
188 
189 
198 
191 
192 
193 
194 


118 
119 
126 
121 
122 
123 
124 
125 
126 
127 
128 
129 
139 
131 
132 
133 
134 
135 
136 


N=1Li9de 


0293~ 
0126 
a782= 
e481~- 
0293- 
o178- 
o187— 
0641= 
o381- 
4225= 
e132- 
0 769— 
0445~ 
0256~ 
0146=- 
0829~18 
0467-18 
0262-16 
0146-16 


WOON ODMADMOVYWAYUH A 


N=1206 


0999— 
0999— 
0999~— 
0998— 
2998~ 
099TH 
0996~ 
0994~ 
0992= 
0990~ 
0987+ 
0983~ 
0978= 
0972~ 
0965— 
0956~ 
0946~- 
0934— 
e921- 
0905~— 
e887— 
o866~ 
o844~ 
0819~- 
0792— 
0763~- 
0732— 
0698~ 
3664~ 
0628~ 
0590~ 
0552~ 
e514— 
0476~ 
0438~ 
6490~ 
0364~ 
0329— 
0295— 
0263~ 
0233~ 
e205~ 
#18G~ 
0156=- 
o135~ 
0116— 
o9B84— 
e832= 
0699— 


PRPPARBARABRATAVAGVASASSRASASGVSEPS AAA SASASVLSVSNsGasV ass esagas 


N=11196 


0358= 6 
0225- 
0141- 
e876- 
0541- 
0331- 
0202— 
e122= 
0732— 
0437- 
0259- 
0152- 
0891— 
0518- 
0299— 
ei71- 
0977-108 
0553-108 
0311-14 
0174-16 


OOO ODWMDONNATENAMH 


N=1129 


0623- 
0397~= 
e251— 
ol57= 
2980~ 
s697~- 
e373~ 
4228= 
0138— 
4834~ 
0499— 
0297- 
e176- 
2183- 
065G2= 
0349- 
e2d1— 
e115~ 
0653-10 


OWOWDMDOMONNIANNHAH OH 


“9369-10 


2207-19 
116-19 


N=113¢6 


0137—- 
2687- 
0438— 
0278= 
o175— 
0189- 
«686— 
e420— 
e257= 
e157- 
0949— 
0570— 
0340- 
0282= 
0119- 
0697— 
0406- 
e235— 
0135— 
2769-19 
0436-19 
0246-19 
0138-19 


OOWVW OW AMDMDVAIYARAADHA w 


N=1149 


e18i- 


ell7~ 
0756~ 
0484~— 
03D8- 
2194- 
0i22~ 
e761~ 
e471= 
029D— 
el77- 
0188— 
0649— 
0389= 
e232~- 
e137- 
28S6—- 
0471= 
o273— 
ei58- 
0993~10 
0514-18 
0291-19 
0164-19 


OOOO MOD OIWIYNNIAADHOOW 





N=1li59¢ 


e391- 


2197- 
0128~ 
«836— 
0533- 
0346- 
°216- 
0136- 
2850- 
«528- 
0326- 
a2aG~ 
0122- 
0738- 
4h an 
0265- 
0158— 
2938— 
0545— 
0318- 
0184— 
0186- 
0695-19 
0344-18 
@194-16 
0189-10 


WOOO WDMDMO SIN VNDHAHAHHOO wi 


ddl 


N=116¢ 


0494— 


2327= 
e215< 
2140~ 
eS1l- 
2587= 
0376=- 
0239= 
e151- 
6948— 
e591— 
0366~ 
0225= 
el38— 
0837- 
05D5— 
0323- 
el8i- 
el Q7— 
0630- 
0368- 
e214~ 
0124- 
0719-18 
0495-16 
0229-16 
0129-16 


we 


WOO UO DDNMDDON NNT HHHD AO Winn 


N=1179 


o8D9=— 


o534— 
0355— 
0234- 
e153= 
s998— 
0645— 
0414— 
2264- 
0168~ 
0195— 
066G— 
0410— 
0253- 
0155— 
0948— 
e574— 
0346— 
o207- 
0123- 
0726—- 
0426= 
0249— 
01l44—- 
0839-19 
0475-19 
e271-10 
0153-19 


OWOUODW OM MOOWYNANVHATQVDAAOUUUD HK 


N=118¢ 


0128~ 
2B62~- 
0578~ 
0385~- 
e255~— 
e167- 
0169~ 
e728- 
0456— 
#292- 
0186- 
ell?= 
0736= 
0459— 
0284~ 
e175= 
eld7~ 
e651~ 
0393—- 
0236~ 
el4l— 
0836~ 
0492= 
o288— 
2168= 9 
0970-19 
0557-19 
0318-18 
0181-19 
0192-10 


WOOOMOMDOAIVNNNAMHHAHOUN UU 


N=1199 


e201i- 4 
e137— 4 
0928— 5 
0624— 5 
e417 5 
e276— 5 
e182- 5 
0119- 5 
o776- 6 
e501— 6 
0322— 6 
e205— 6 
e1i3G- 6 
e819— 7 
eS513~ 7 
0319- 7 
e197- 7 
el2l- 7 
e737- 8 
o447= 8 
e269- 8 
el61- 8 
2969- 9 
0567=— 9 
0333-9 
0195= 9 
ell3~ 9 
0652-19 
0374-16 
0213-16 
0121-12 


—~SECRET— 


R P=1/1¢6 


164 


165 
166 
167 
168 
169 


187 
188 
189 
199 
191 
192 
193 
194 


114 
115 
116 
117 
118 
119 
12¢é 
121 
122 
123 
124 
125 
126 
127 
128 
129 
134 
131 
132 
133 
134 
135 
136 


SECRET 


R 


137 
138 
139 
149 
141 
142 
143 
144 
145 
146 
147 
148 
149 
156 
151 
152 
153 
154 
155 
156 
157 
158 
159 
1690 
161 
162 
163 
164 
165 
166 
167 
168 
169 
1708 
171 
172 
173 
174 
175 
176 
177 
178 
179 
18@ 
181 
182 
183 
184 
185 
186 
187 
188 
189 
198 
191 
192 
193 
194 
195 


N=1200 


0583- 
0482= 
e397= 
0324— 
0263- 
e212- 
0169- 
0134— 
«196- 
e831- 
0646- 
0499 
e383- 
0292- 
e221- 
«166- 
el24a— 
0916=- 
eb T4— 
0492- 
0357 
0258- 
0184= 
e131- 
0926- 
065B- 
0453— 
o313~ 
e215- 
0147 
0999— 
2673~ 
0451 
0300— 
0198- 
e138- 
0849— 
0550— 
0354- 
e227- 
0144- 
0910— 
o571- 
0356= 
e221- 
0136- 
0833- 
0507 
0306- 
0184— 
o1id= 
0652- 
0384- 
e225= 
el31- 
0760-108 
0438-18 
0250-18 
0142-18 


wowovowvoe 
DDBWOAHNNANAARHOHATWMUMUMUMMU FHL ESE FUWWWWUWWANNYNNYNNN NRE EY PR eR ee 


02 


R 


137 
138 
139 
142 
141 
142 
143 
144 
145 
146 
147 
148 
149 
158 
151 
152 
153 
154 
155 
156 
157 
158 
159 
160 
161 
162 
163 
164 
165 
166 
167 
168 
169 
170 
171 
172 
173 
174 
175 
176 
177 
178 
179 
180 
181 
182 
183 
184 
185 
186 
187 
188 
189 
198 
191 
192 
193 
194 
195 


P=1/108 








AppENDIX 5 


PLAINTEXT AND RANDOM MATERIAL FOR SAMPLING PURPOSES 


. 1000 Letters of English Plain Text 

. 1000 Letters with Theoretical English Plaintext Frequencies 
. 1000 Letters of Random Text 

. 1000 Digits of Random Text 

. 1000 Characters of Random Text (82-Element Alphabet) 
25 Random 26-Letter Alphabets 


Sepoawp 


* ok * * 


In the study of a cryptographic system, the cryptanalyst often finds it expedient to encipher a known 
plain text and then examine the phenomena which arise. Or again, the analyst may use a certain kind of 
text as key and observe its effect in the resultant cipher text. This Appendix presents samples of the 
principal types of text useful in experimentation. 


553 “SECRET. 





2 a A R a % 
FHEACAUEATMOOHHYAMNEANAERDAHMHOODOH 
QNHHOAZHOMS A THHEDHDDANHHOOMHEAQEALrA 
MHNNOHAHHOUMESDTACONATHABZHORHHA Shams 
PHREONGANARHMOHRMAEHAHS HHS eNOS ONME TO 
ZDHAdASHMONAKEASAHMEDAZOMSHMANOMTOETEHO 


He teHOorMSeHOHHOUMHOHONOHHYAZANAHE HON 
DCO BHFADTAMOSEANNOSZSGOAHOMURAHUBMNM RAN TD 
HROTMOHSZNHRORIRAMRAZOAMHASSOMRHS aD VY 
BANE KMD AMA RAHD HM TMOHOMAMHMMDONHOrAY 
HRHAZ RADAR HMOAKTHRHEHAHHAKMHOMNAdCaANRaA a 


FON MHA RA MAHAMNHARNROSBNANNHHNANMHEASD 
SMAZHOINNHMHNNERNOMAHHR OMAP NAM neN 
AAMTOOHMNOHRMHFHAAAPrPrFHNAMTOFRMdAmMdOmoOadHD 
HAH MAOHMAMOAZOMOOOMMASHARR YH HHAYRM 
OF EBSRAMORTAAAHMOAMMAMRLOMAZARTMaAddaanwan 


NH ARHOUMHTMARHDOLADZYHANAOTOSUHDEOR, 
Hat DER OM HOHANNHNHREAODHOZOHSZHe MYON 
THANNHNHMODNHAAHTHMAMHE EH ZOHHOHMMaANE 
HROZHOHPMHNUHNTDHHOUSHHAHHETNHNO ADEN 
HNHHHM AND AZAADHHNZHAZAONZHHEN HRS ORE 


SNR RA MHORDAZHOANHRHH MA DHH MH MOH Pea aetna 
Tet HMHPSHODROVOHOOMOHKAUAZAHAMAMACMZAHYIHS Oa 
FOMHTNHAZOLRAMSEMAAHDMHONOHEFOHAHHDAHNHaAA 
HE AZADA ZTROUIA ZAMAN AA HHMHOHMOAANQGVAUYEEEA 
OMOPAHHFOFSDADTHMHAHHPHHADARAHANHHHAL 


TOSHAASNAZANMHHOOAMTAAAZHHONRHAOMHE OMAN 
RHP SASH K MUON R ABE MHHMHNODA TAHOE Me Sb 
AQ MNOMRFHOMZHHOMUHOZHHOZHHMHARNHOAN<AO 
TOMMUNMRhRAPHMAAAHOUOAZHIDAOHMRAHMABS YAO 
PHS SHPMOPAHOOMAZTRAZAAHHOHEFHOWIHSDADASN 


PLAINTEXT AND RANDOM MATERIAL FOR SAMPLING PURPOSES 


A. 1000 Letters of English Plain Text 


RM meee ea, A er 


Distribution: 
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B. 1000 Letters with Theoretical English Plaintext Frequencies 


5 


mAN 
AEA 
uO 
A 
av 


Ah 
Ao 
pO 
aH 
ee 


He 
fl 
Oo 
Qe 
4 fe 


ATTLS CVUEA TZF 


D 


fl 


CEI TAWEF SREYC ITOGOE 
TLN RWEOO ERSRR SPERE 


aH 
Aa 
maw 


HHO 
onwn 
me 
Hod 
Mdm 


ULMD AY 
OFSE AE 


EUS 
WA © 
2 fH 
Hom 
OMAHS 


TOV I 
NIH N 
MATEW ATEXI FCREN SAUTE URSTI MNSDT 


ENTTN FSXNU NRULM OROGI EIARE REENN 


LTO 
L I 


RDEAE TSPER LTANE IRRNO ECQAF NTHUN 
TONBN ELTOFD OSMEE DTESP TTREA GHU 
HSAOT HRTHE VFIWL JSWLI TNEAG ERR 
NNCTI NENLR OTOET FCRNS LPUTP USO 


ECTSW ANOTI ECITI IRTET 


MSHoOnRH <s 


E 
0 
I 


z 
fa 
Ei 
> 


BE 
ea} 
oO 
wn 
fy 


BH 
<< 
i. 
BL 


oOo 
=A 
1 
mm Fi 
= fy 


E 
D 
ABETT ONTNF OITHF 


HE 
fl Gi 
AM 


NYO EWOTO ALINB 15 


CTEPA ESTVN IMSOE ASADR SUYNR DICIV 
SSMEO ITEAHF UCYNW YENAT RDTAD MADEE 


MEHEE TEPAC YWNON UPHTT MODMU 
TROOA NNEES TGTOG ELTEEH CT 


eats omma 
ODTxMOMHEA 
AkRMAMaAD 
RH mH O 


o 


o 


= 
oO 
2 


oO 
N 


NNnNDHAN 


eetnN 
NetOWS 
MEH 
HONtH 
aed nNo 


HEomM<d 
nostan 
AZAndMm 
BSmaASZS 
AmMmAM aM 


UEAU ITHGOT VEDSE 25 


FAE RTTAT RHNLE TRNET TEFAC 
OUV ITUNRG RRRET EEOPE EPRDE 


CHE aen 


2mMuMAMN 
Heamanya 
OHMHNO 
ZHPORtH 
aAatnaan 
H200OnrA 
terrae 
HAAMHOWSA 
MmMrohrmiongd 
MORHS AAH 
AxtmMmohwAmaA 
e_qHhneomo 
AmMHA neta. 


HOGHNARH 


WATSW PAARR NAOEE 
TCANE YLARD MICOT 


H 
0 


ao 


TS 
RN 
TOM CYTTX NYDLR TESAO LENVT 


D 
S 


MY 
as 
HA 
Bk 
f] & 


aa 
ue 
mo 
fel fe 
oA 


30 


R 
A 


<< 
a 
ro 
eR 
Hi Ay 


EEOT 
HOPE 


i E4 
EI iH 
aH 
= 
of 


Fe) 
= 
aa 
Ay 
ao 


fe] < 
fk] O 
~~ > 
qa 
> fy 


AH WN 
Bo &l 
AH 
HR 
MwWo 


OO & 
an 4 
Zn 
romnd 
BR2MGMHO 


TN YHEOM CENPN CHNNE DANVD 
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CO. 1000 Letters of Random Text 


Lo 


FPUNNMMHARMETAZAIHOH 
CHNHAMH ANON END 
HreEereeresa 
ty O ki <i p4 
Mm em TA Ay 


YM AA SO 
BEN tea MN 
aHPHOM 


EFNUODNHO 
HOAZNNEh&E 
Ath OM Om 
Pina 
ONPRrR CU 


any epo 
K&N OM ML 
EMH Me OD 
mRON Lk 


SOE DP my 
ANHHNNSA 
BOANHAA 
ma om Me 
MnNnaONGA 
NkUS 

HANNE E 
NOAM N 
mhOUOWERO 
BONN OM 
a Wate hyd 


OSZMNAMS 
Cnkm aE 
oHmoddkh 
OAM sr Tm 


fA 
n 
wd 
= 
oJ 
° 
m 
oO 
kl 
a 
= 
Lao 
ry) 
mG 
o 
= 
> 
P< 
> 
n 
oe 
amounanm 


o 
eat 


oaPrPsana 
eat hoatad 
2NP HEU 
=aONhO WM 


Hataonna 


aM ke aS 
AMPEA 
tm OH 
QHArMN 
MDE Mm 


oNN 
HE2aMm 
DAY ml 
oBUM 
opp 


DLJIT YVD 


ermatno 
BONDS 
NOkhO A 
NS Lae 
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D. 1000 Digits of Random Text 


4 
12 
157 
860 


46585 33365 29172 86725 3049 
03278 30680 00220 14984 663 
01313 22197 38742 40168 43 

23 25409 60368 99826 60597 10129 


9376 02869 24794 78834 58446 51 


NTA oO 


5 


293048 56608 39318 51264 24459 
452508 91414 85424 91555 72769 


19 
764 
167 


0 oO 


340120 80798 79750 08040 10 


5 6582431569 99089 84721 


NN 


20387 80270 62935 88043 35124 
622 27851 23622 54125 25502 


95548 
093 


5 
9 


74854 83731012822 03033 12949 89210 


36375 62962 90430 40784 0092 
8182091854 81424 09005 8357 


23 


a 
Att 
Noworb 
nonoOD oO 
ornra <i 
ovnoo 
rFMOoOOL 
onaoor wm 
AN ONW 
tO M OOD 
oHowtro 
ONMOD 
Noto. 
tovoo 
omonor 
tooor 
otnAnnm 
YOO 
bAADN 
OMNOR 
oortn <a 
ONMMA 
ooroqgm 
o> 


T 
2 
5 23 
35 7 
814 


ornoao 
AOD 4 
anHAMM 
ovt om 
DANMON 


amo 
Ow o 


T 
6 


mo 


6 
7 


83062 58392 49638 42762 84583 20 
300 80955 97918 08884 69845 374 


71278 3861453523 12046 


5 
6 
129 89651 96264 00290 01423 


OM 
oO WwW 
maw st 
owt wv 


i oO 

nN ™ 
MoOonrwtwOoOROoOrtr © 
ADANMDOHDOD 
DONDOHAHMNOMAWM 
ADHDOONMHALrN 
rMNOoOTMEOoOMDL 


[OOMPrAaaAYTARNA 
OrotHAHODAnNownnm 
FMNARDANAENAYN 
oOor~rnaonorwtnr 
OCOONOYTNNONOL 


rOOrOnANAA 
OFAADADNMON 
rFMOnRADOMOPR OA 
ONO HADADHON 
YoOYrODNOANANN 


NOAH TON TD 
NHNDANNOARADNOAM 
MMNMNHONDA TOD 
ANMDAMONYE ME 
Yroooattnan 


artnaroanrnroar 
ANNE ADAANNODM 
NDAHMOoONWNMNOoOrFKEN 
oortatHtNbrHOoONM 
DHMAANTAMNONNAD 


Hooadantronnaor- 
FRUONOVYNMOONMANA 
AOMNODMDNANAYOMNM 
ONNOANANANADOHOH 
NOANDODAMrANE MND 


Distribution: 


058 


E. 1000 Characters of Random Text (82-Element Alphabet) 
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APPENDIX 6 


BASIC LETTER FREQUENCY DATA, 24 FOREIGN LANGUAGES 








These data are based on selected samples of newspaper text, communiqué style, of between 50,000 and 
67,000 letters in each language, with but one exception (Slovak, with 46,026 letters.) 








BASIC LETTER FREQUENCY DATA, 24 FOREIGN LANGUAGES 


1. ALBANIAN 


1-a. Absolute frequencies of single letters of Albanian plain text, arranged alphabetically, based on 57,851 
letters of text. 


A 4,441 E 5 142 I 4 890 N 3 545 Rr 178 Vv 776 
B 639 E 6,604 J 1 233 Nj 420 S 2,054 Xx 9 
C 213 F 545 K 2,207 0 2,431 Sh 1,281 xh el 
¢ 198 G 590 L 875 P 1,915 T 4,876 Y 296 
D 1,161 Gj 325 Ll 381 Q 855 Th 207 Z 398 
Dh 538 H 451 M 2,185 R 3,951 U 2,005 Zh 17 


1-b. Monographic kappa plain, Albanian language =.0604 (I.C. =2.17) 
1-c. Frequency distribution of single letters based on 57,851 letters of Albanian plain text reduced to 
1,000 letters, and arranged according to their frequencies. 


EB 114 N 61 P 33 Vv 14 Nj 7 Th 4 
E 89 0 42 Sh 22 B ll Zz 7 ¢ 3 
I 85 K 38 Je 522 G 10 Ta 27 Rr 3 
T 84 M 38 D 20 F 9 Gj 6 Xh Gf 
A 7 S 36 L 15 Dh 9 Y 5 Zh G 
R 68 U 35 Q 15 H 8 a A x g 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 57,861 letters of Albanian plain text. Percentage of 7 most frequent letters in Albaman plain 
teat. 

Vowels E, E, I, A, 0, U, and Y =44.6% 

High-Frequency Consonants T, R, N =21.4% 

Medium-Frequency Consonants K, M, S, P, Sh, J, and D =20.8% 

Low-Frequency Consonants L, Q, V, B, G, F, Dh, H, Nj, Z, L1, Gj, C, Th, @, Rr, Xh, 
Zh, and X =13.2% 

7 most frequent letters (in descending order of frequency) EF, E, I, T, A, R, and N =58% 


1-e. Absolute frequencies of single letters as initial letters of 18,249 words in Albanian plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


T 1,252 Sh 571 Nj 538 J 187 Z 137 Rr 15 
P 1,223 5 561 F 315 G 182 C 126 Y 10 
K 1,050 Q 415 E 259 H 175 Ei 112 xh 4 
N 993 Vv 380 L 257 R 170 C 90 Ll 2 
M 978 B 370 Gj 225 I 156 0 81 
D 605 A S51 Dh 221 U 138 Th 56 


—SECRET— 


2-a. Frequency distribution of digraphs based on 57,851 letters of Albanian plain teat, reduced to 5,000 
digraphs. 





















































































































































A —2| 2i17j19|17| 4|23/4s| 3] |1s{11[5s| 6|19|19/51| 3] i112) | | i] 61 
B Pi t4 [ta [tt ta i ta tT Tt 7 |_| 
c fp EVO Pel te ete Wisc ae os i pe [sil he if] 
¢ 2 | | it UA de esl PoP 
D | ep ee he | 
Dh = oe edhe sete. 4 poh dead 
E l26[ 9|47| 2i26|1 7/72) 2] 3[14 4 | 
E [35|11/79| 2/46|37/66] 2] Alig 7 | 
F cs Pte Se Eee Tere PE hg 
G a Pee aE od SE led 2S vee 
Gj |_| eS ole ee |_| 
H a rat | | dT yh Tt ay 

I 51] liz} [4ojiel4s] es} sl al [| [tol | 
J | Beh Beas A elaO at Ps pee 
K | 1 | [33] a) 4) Tal | 6 a7], | ft a 
L || fa fa fal fy el ahs Aa 
Ll Fe bees see] ee tes [oe Pe oD ae cde a eet | 
M | | af 2] afrof 4} ipa} [al ta) fetal | Ct 
N | | 4) ei 6] 5] 2) | 2) ai 2 ted, 23 
Nj Paap Ee ie [a eee 
0 51227] 4) 3/11] 32g] 3/22) 1/32] 1) af 4) | af et 
P g4e, | | | | 6 ; 2, tf fay yes} | feof Tay Ts) fiat TT 
Sed ated 55) (a) ee Slee teal dekh a yf a a: sy Poe [ad 
R [44] 4] 1/2) 3] 1/47/37] 3] 6] 4] sis] 2/12] 3] [21] | 3/15] e] 4] 1) | 8) 5j17] 111/ 2] | | Sl | 
RES chlo ase Alc specie opel epee dhe ean) tl seg te [ii 
5 Lif | ef) 2eeze 3) | 1 7 Ud S| 5] 1a2y s] 1) ay 7] iol | say fy i 
Sh _4> [pf | [iif ais] | [3] af | 4) sist | | (33, [eat | tt 
T (4o/ 1[ | | 3] 2lasiiao2 | a) | i45iio} 5] 1) | S| | 225] 9f 4/20] | 4| 2li7| [isi 2] | ft 4 i 
Phe al so) Me ela oeh ape eale ir aL ee cei ie tea de tes 
u (30, 2] | [3] 2 ay 5) 2) fe] ay 3/23] 3] 710/30] || 5] ifee} 2] 6] 4] os] [ felt | [at | 
vis | i [a spo T | Pros fat TE es te a 
x fel esp a] |e eats Peep Pe heed [ate eee a | 
eae) SRE) ER Pe (PP Ped He A SV a Ve 
fk eas ctl of ah SOI hfs ife fee aS ile Spe aaa 

a qat{ {fas | ty Bd eh ee) el Peis 

















2-b. Digraphic kappa plain, Albanian language=.0061 (1.C.=7.91) 
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2. ARABIC 


1-a. Absolute frequencies of single letters of Arabic plain text, arranged alphabetically, based on 58,472 
letters of text. 


1 10,391 a Leet - 355 S 967 
~ 1,725 3 470 b 535 J 5,958 
= 3,411 2 2,526 4: 93 ? 3,204 
e 253 j 341 C 45838.) o* 2,771 
t 657 m 1,330 é 216 ¢ 1,935 
c 1,009 |v 463 3 1,524 9 3,023 

c A432 - 533 S 1,260 $ 4,536 


1-b. Monographic kappa plain, Arabic language =.0811 (I.C. =2.27) 
1-c. Frequency distribution of single letters based on 58,472 letters of Arabic plain text reduced to 1,000 
letters, and arranged according to thew frequencies. 


1 194 9 857 » 32 ] - 16 3 9 eo § 

J ill o 62 ~ 32 S 18 7 fe) & 4 

$ 85 2 AT 3 28 ¢ 12 ct 8683 ‘be 
x 6A 6 36 wm 25 +b 10 v2 7 
- 60 & 34 5 24 | #10 3 6 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonanis, in 53,472 letters of Arabic plain text. Percentage of 8 most frequent letters in Arabic plain text. 


Vowels | ,¥, and 2 =33.6% 

High-Frequency ConsonantsJ 2, ?,o, and » =33.4% 

Medium-Frequency Consonants 4,£, 3, ,4,0%,.5, €, and S =24.9% 

Low-Frequency Consonants Ct, byw, 58,6, 5.4, &, and b =8.1% 

8 most frequent letters (in descending order of frequency) 1,J,%,~,f,9,0, and » =64.6% 


1-e. Absolute frequencies of single letters as initial letters of .11,496 words of Arabic plain text, arranged 
' according to their frequencies. (One-letter words have been omitted.) 


1 4,122 J 549 e 214 & 140 3 61 ea 27 
f 905 & 548 mw 204 J 133 b 61 5 25 
» 880 ~ 442 S§ 203 » 109 P 56 Sb 7 
3 776 $ 334 tc 202 ¥ 76 e A2 
~~ 591 5 223 o 152 c 70 & 29 


565 -SEGRET— 


2-a. Frequency distribution of digraphs based on 58,472 letters of Arabic plain text, reduced to 5,000 


digraphs. 


> (STSTSPP PPR a Tse el Ta] 18/8 [* [8 [8 ]s[*]8/°| 
sfelttel [eT [et falee (pele fey fersfe(e[sals[a lela 
Hae ester ieee eis Pie | 
ofeleferrry PRT RT ey Pest [ei feraisi |? /a/s 
~falsfe(e Pita (Pete retetetet fale Pre [sfel? (a [81a [8| 
>felate]ele errr iefelers | isi falP lr isis [?/F [8/3] 
sae oe ee Pe Se eee eee eles 
meee ee en Pr eae 


§ 
yi N 
i 


aleiRie PEPPER EE PEP EP Err Erte 
ee OPER PERE PET eee rer ere 


=F Se ee ss 





7.92). 


2-b. Digraphic kappa plain, Arabic language=.0101 (1.C. 
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3. BULGARIAN 


1-a. Absolute frequencies of single letters of Bulgarian plain text, arranged alphabetically, based on 
55,689 letters of teat. 


A 6,543 Bs A426 M 1,166 T 4,331 I 299 
B 849 3B 1,203 H 4,226 Vv 759 I 344 
B 2,579 W 5,245 O 4,959 oO 161 b 988 
FE 816 u 35¢ T 1,561 x 258 b 13 
I 1,949 K 1,'723 P 2,799 a4 A422 10 Laid 
E 4,987 JI 1,829 C 2,993 7 722 A 1,195 


1—b. Monographie kappa plain, Bulgarian language=.0647 (I.C.=1.94). 
1-c. Frequency distribution of single letters based on 55,689 letters of plain text, reduced to 1,000 letters 
and arranged according to their frequencies. 


A 117 C 54 I 28 r 15 m 6 
MW 94 P 56 3 22 yV 13 m 5 
E 89 B 46 M 21 Yq 13 x 5 
Oo 89g IT 35 A 2 KK 8 > 3 
T 78 I 33 b 18 It 8 10 2 
H “6 RK 31 B15 iw 6 b @ 


i-d. Percentage of vowels, high-frequency consonanis, medium-frequency consonants, and low-frequency 
consonants in 55,689 letters of Bulgarian plain text. Percentage of 6 most frequent letters in Bulgarian 
plain text. 

Vowels A, U, E, O, A, 'b, V, MW, 1 and b=45.9% 

High-Frequency Consonants T and H=15.4% 

Medium-Frequency Consonants C, P, B, JJ, JL, K, I, 3, M, B, T, and T=36.2% 
Low-Frequency Consonants JK, I, I, II, X and =3.4% 


6 most frequent letters (in descending order of frequency) A, U, E, O, T and H=54.4% 


l-e. Absolute frequencies of single letters as initial letters of 10,421 words of Bulgarian plain text, 
arranged according to their frequencies. (One-letter words have been omitted). 





H 1,284 O 611 T 433 P 364 A 117 @ 93 Wl 8 25 
C 1,191 K 518 B 364 T 232 Y 114 Tq 82 JO 18 
Il 1,622 B 488 M 349 Yd 197 I 198 we OS] A___ 13 
a 713 3 ATT MW 319 E 126 Mm 1¢¢ xX 39 9,379 


s Su rR bb atk OM HOHHOMB HABE oO RAH woe 








2-a. Frequency distribution of digraphs based on 56,689 letters of Bulgarian plain text. 


A BBTrRAERSBHUHKREUMAOTPCTY OxXTAemmMmpeEwWaA 
[a fis[arfaaer|so] é[si]a6| 626] 20] 25]s]is|s2|4o[si[ra] 3] 2] 5] Tho] el 6[ | [2/5 
rs al pall fal | fel _|2pel fetal fal Par | | fame el 
s| a s| a a[sal | a[zal al 3] 3] 2]i0)%0] 4] [is] ol Ps 
a Sia 
2 2) sfiehisl a} a| 6 - 
F3| 8[36[75[a5| | 725) 15 | 322] se] zi] e5| 5] z2|%5|46/56] sf a] at alo) sp 7] TT (a) | 
retiar | fel tal | tat 
ala| 72) als} Sale| [4 3 4] of 3] 5] a] a 
af 5[2i| 7|za[z5| afza)z4| 3 20] 5] 07] 4a)6] 6)i5| 39 
1 J: 
1 
1 






ht 


KB 
wn 






| 1 or | | 
1nw 1O)r ta 
1A) OoO1r nN, 
=H 
roy 
| | 
| | fst 













rar Pslal at s[a] apa s 
spat e( (apa el Lat [etal [pe 
5 real] afse[ Ta [fisleo[ a] [ap 
arf a] 3/3] 2fee] [ahs] [af apa] sie] ef a] aa 
es 2] 2| | 5|40] | sla5| a| =| a] | s[a6| 2] 13s 
[ao rs) 926 223) 26) i5|s6| [zo ai] 22 
st pet eel [fa] CeCe 


wa 
ad 
E [| 


*RERE 
[w| 29| 
el 
= 

w| [E| 
| 
e 
| | fe 
la 


e 
bh 
o 
~~ 
S| 
| 
r 
Ww 
o 
oa 





erie 

h 

| 

| [afr 

wn 

ale} o 
AOS 


JR 
i 
wilw]aloala 
WN 


0) 

: 
Ble 

H 

Lexy 

oOo 

ie 

EI 

{ 

: 


























Zest aU eee ee See 
Peso eels de Paes ee ae) 
































ra 7 
a i a a a OS a | 
a eo cer els eee) 

SoC eEREELREGRG BRR aREBrrryy 


2-b. Digraphic kappa plain, Bulgarian language=.0069 (I.C.=6.21). 
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4. CZECH 


The frequencies of D, 6, R, T, 0, Y, and Z are included respectively with those of D, 0, R, T, U, Y, and Z. 
The letter W is derived from the foreign words included in Czech plain text. 


1~a. Absolute frequencies of single letters of Czech plain text, arranged alphabetically, based on 62,107 
letters of text. 


A 4,016 D 2,466 G 219 J 1,086 N 26 S A434 W 39 
A 1,525 E 4,740 H 797 K 2,143 0 5,249 T 3,288 Y 2,091 
B 1,251 E 728 Ch 528 L 2,847 P 2,050 U 1,988 % 2,078 
Cc 964 E 972 I 2,917 M 2,072 R 3,101 UG 466 
¢ 576 F 121 = 1,697 N 4,285 S 2,771 V 2,576 


1-b: Monographic kappa plain, Czech language=.0465 (I.C.=1.53). 
1-c. Frequency distribution of single letters based on 62,107 letters of Czech plain text, reduced to 1,000 
letters and arranged according to their frequencies. 


0 85 R 50 D 40 P 33 Jat Gé 9 F 2 
E 76 I AT K 34 U 32 c 16 Ch 8 Ww @ 
N 69 L 46 Y 34 = 27 E 16 G 67 N @ 
A 65 S 45 Z 33 A 25 H 13 Ss 
T 53 Vv 42 M 33 B 20 & 12 G 4 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants of 62,107 letters of Czech plain text. Percentage of 4 most frequent letters. 


Vowels 0, E, A, I, Y, U, f, A, B, B, and U=42.5% 

High-Frequency Consonants N, T, and R=17.2% 

Medium-Frequency Consonants L, S, V, D, K, Z, M, P, B, and J=34.4% 
Low-Frequency Consonants C, H, G, Ch, S, G, F, W, and N=5.9% 

4 most frequent letters (in descending order of frequency) 0, E, N, and A=29.5% 


1-e. Absolute frequencies of single letters as initial letters of 11,696 words in Czech plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


P 1,354 B 614 0 446 € 143 | I 44 Ww 16 
S 1,056 D 603 A AOl L 130 j; Ch 40 Z 3 
N 948 M 572 R 349 c 106 G 33 Y 3 
Z 908 J 490 U 181 CG 87 S$ 32 B12 
V 780 K 460 H 158 F 71 E 27 Lt 

T 630 


569 —SEGRET— 


2-a. Frequency distribution of digraphs based on 62,107 letters of Czech plain text, reduced to 5,000 


digraphs. 
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2-b. Digraphic kappa plain, Czech language=.0042 (I.C. 


5. DANISH 


NOTE: The letters W, X, and Z are derived from foreign words in Danish plain text. 
1~a. Absolute frequencies of single letters of Danish plain text, arranged alphabetically, based on 56,176 
letters of text. 


A 4,434 G 2,358 M 1,755 S 3,452 x 1 
B TAT H 807 N 4,370 T 4,098 Y 370 
Cc 87 I 3,479 0 2,341 U 899 Z 8 
D 3,906 J 339 P 624 V 1,379 AZ AT2 
E 9,021 K 1,727 R 4,739 W 13 g 511 
F 1,459 L 2,'780 


1~b. Monographic kappa plain, Danish language=.0730 (I.C.=1.97). 
1—c. Frequency distribution of single letters based on 56,176 letters of Danish plain text reduced to 1,000 
letters, and arranged according to their frequencies. 


E 161 I 62 K 31 B 13 J 6 
R 84 Ss 61 F 26 P dil Cc 2 
A 79 L 49 Vo 25 g 9 W 0 
N 78 G 42 u 616 A 8 Z 0 
T 3 O 42 H 14 x 7 x 0 
D 70 M 31 


i-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonanis in 56,176 letters of Danish plain text. Percentage of 8 most frequent letters in Danish plain text. 


Vowels A, E, I, 0, U, Y, A, and =38.3% 

High-Frequency Consonants D, N, R, S, and T=36.6% 

Medium-Frequency Consonants F, G, K, L, M, and V=20.4% 

Low-Frequency Consonants B, C, H, J, P, W, X and Z2=4.7% 

8 most frequent letters (in descending order of frequency) E, R, A, N, T, D, I, and S=66.8% 


1-e. Absolute frequencies of single letters as intial letters of 10,749 words in Danish plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


D 1,205 0 613 B 384 N 236 C 20 
S 1,054 H 578 I 373 L 234 Y dil 
A 881 T 543 P 310 R 186 W 8 
F 822 V 493 G 269 J T4 A 8 
E 713 K AO0T U 247 g 651 Z 1 
M 644 


——SEGRET— 


2-a. Frequency distribution of digraphs based on 56,176 letters of Danish plain text, reduced to 5,000 
digraphs. 
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2-b. Digraphic kappa plain, Danish language=.0094 (I1.C.=6.85). 
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6. DUTCH 


SECRET 


1-a. Absolute frequencies of single letters of Dutch plain text, arranged alphabetically, based on 59,998 


letters of teat. 
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1-b. Monographic kappa plain, Dutch language=.0758 (I.C.=1.97). 
1-c. Frequency distribution of single letters based on 59,998 letters of Dutch plain text reduced to 1,000 
letters, and arranged according to their frequencies. 
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1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 59,998 letters of Dutch plain text. Percentage of 8 most frequent letters in Dutch plain teat. 


Vowels E, A, I, 0, U, and Y=40.8% 
High-Frequency Consonants N, R, and T=23.4% 


Medium-Frequency Consonants D, S, L, G, V, K, M, P, and H=28.1% 
Low-Frequency Consonants B, C, W, Z, F, J, Q, and X=7.7% 
8 most frequent letters (in descending order of frequency) E, N, A, R, I, T, 0, and D=67.3% 


1-e. Absolute frequencies of single letters as initial letters of 9,520 words in Dutch plain text, arranged 
according to their frequencies. (One-letter words have been omitted). 
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2-a. Frequency distribution of digraphs based on 59,998 letters in Dutch plain text, reduced to 5,000 


digraphs. 





[4] 9|32] 1 | 








rahi sf 6[-4pe[ a 

| ja] 2 2}a] | fst | 

SPSpeeEL 
12 


2~b. Digraphic kappa plain, Dutch language=.0094 (1.C.=6.35). 
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7. FINNISH 


NOTE: The letters Q, W, X%, and Z are derived from foreign words in Finnish plain text. 
l~a. Absolute frequencies of single letters of Finnish plain text, arranged alphabetically, based on 62,261 
letters of text. 


A 7,367 L 3,442 S 5,241 6 360 G 71 
E 5,232 M 2,240 T 6,603 B AA Q 1 
H 1,113 N 5,333 U 2,953 Cc 21 W 10 
I 6,508 0 3,482 V 1,544 D 703 x 3 
Jf, Are P 908 Y 1,'705 F 55 Z. 2 
K 2,830 R 1,231 A BRT 


1-b. Monographic kappa plain, Finnish language=.0737 (I.C.=2.11). 
1-c. Frequency distribution of single letters based on 62,261 letters of Finnish plain teat, reduced to 
1,000 letters and arranged according to their frequencies. 


A 118 0 56 V 25 D il G6 
T 106 L 55 R 20 666 Ww oO 
I 105 U.! :47 J 19 G 1 x 0 
N 86 K 45 H 18 Be ail ZO 
S 84 A 44 Y 17 B ol Q 0 
E 84 M 36 P 15 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 62,261 letters of Finnish plain text. Percentage of 6 most frequent letters in Finnish plain 
text. 

Vowels A, E, I, 0, U, 1, 2, and Y=47.7% 

High-Frequency Consonants N, S, and T=27.6% 

Medium-Frequency Consonants D, H, J, K, L, M, P,-R, and V=24.4% 

Low-Frequency Consonants B, C, F, G, Q, W, X, and Z=0.8% 

6 most frequent letters (in descending order of frequency) A, T, I, N, 5, and E=58.2% 


1-e. Absolute frequencies of single letiers as initial letters of 7,836 words in Finnish plain text, arranged 
according to thew frequencies. 


S 938 Vv 608 L 326 U 97 G 12 
T 820 M 568 A 313 I 83 A ll 
K 754 E 546 N 293 B 32 c oU(UA 
J 654 P 459 Y 153 D 28 W 4 
OQ 613 H 329 R 132 F 28 


—GEORET— 


2-a. Frequency distribution of digraphs based on 62,261 letters of Finnish plain text, reduced to 5,000 
digraphs. 
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2-b. Digraphic kappa plain, Finnish language =.0082 (1.C. =6.44). 


8. FRENCH 


1-a. Absolute frequencies of single letters of French plain text, arranged alphabetically, based on 55,758 
letters of text. 


A 4,480 G 624 L 2,737 Q 616 V 801 
B 406 H 276 M 1,617 R 4,117 W 6 
Cc 1,944 I 4,230 N 4,406 5S 4,564 X 317 
D 2,198 J 184 Q 3,255 T 4,057 ¥Y 100 
E 9,354 K 25 P 1,689 U 3,045 Z 84 
F 646 


1—b. Monographic kappa plain, French language =.0777 (I.C. =2.02). 
1-c. Frequency distribution of single letters based on 55,758 letters in French plain text reduced to 1,000 
letters, and arranged according to their frequencies. 


E 167 T 73 Cc 35 Gai JI 3 
S 82 0 58 P 30 Q il Y 2 
A 80 U 55 M 29 B 7 Zo 
N 79 L 49 v 14 xX 6 K 1 
I 76 D 39 F 12 H 5 W @ 
R 74 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 55,758 letters of French plain text. Percentage of 8 most frequent letters in French plain tect. 


Vowels A, E, I, 0, U, and Y =43.8% 

High-Frequency Consonants N, R, S, and T =30.7% 

Medium-Frequency Consonants C, D, L, M, and P =18.3% 

Low-Frequency Consonants B, F, G, H, J, K, Q, V, W, X, and Z =7.2% 

8 most frequent letters (in decending order of frequency) E, S, A, N, I, R, T, and 0 =68.9% 


l-e. Absolute frequencies of single letters as initial letters of 10,748 words in French plain text, arranged 
according to their frequencies. (One-letter words have been omitted). 


D 1,445 L 784 I 315 U 250 H 67 
P 929 S 664 F 313 0 177 Z 7 
E 894 Q 3594 T 3505 G 146 K 5 
A 866 R 389 N 278 B 115 Ww 38 
C 816 M 337 Vo 263 J 98 Y 3 


2-a. Frequency distribution of digraphs based on 55,758 letters of French plain text, reduced to 5,000 
digraphs. 
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2-b. Digraphic kappa plain, French language =.0093 (I.C. =6.29). 


USECRET- 578 





—SEORET— 
9. GERMAN 


l-a. Absolute frequencies of single letters of German plain text, arranged alphabetically, based on 60,046 
letters of text. (The letters X and Y are derwed from foreign words contained in German plain text.) 


A 3,601 G 1,921 L 1,988 Q 6 Vi 523 
B 1,023 H 2,477 M 1,360 R 4,339 W 899 
Cc 1,620 I 4,879 N 6,336 S 4,127 xX 12 
D 3,248 J 192 0 1,635 T 3,447 Y 24 
E 10,778 K TAT P 499 U 2,753 Z 654 
F 958 


1-b. Monographic kappa plain, German language =.0787 (I.C. =2.05). 


l-c. Frequency distribution of single letters based on 60,046 letters of German plain text, reduced to 
1,000 letters, arranged according to their frequencies. 


E 180 T S7 G 32 F 16 P 8 
N 106 D 54 0 27 W 15 J 3 
I 81 U 46 C 27 K 13 Y @ 
R 72 H 41 M 23 Z ili xX Gg 
Ss 69 L 33 B 17 V9 an) 
A 60 


1—d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 60,046 letters of German plain text. Percentage of 8 most frequent letters in German text. 


Vowels A, E, I, 0, U, and Y =39.4% 

High-Frequency Consonants D, N, R, S, and T =35.8% 

Medium~Frequency Consonants B, C, F, G, H, L, M, and W =20.4% 

Low-Frequency Consonants J, K, P, Q, V, X, and Z =4.4% 

8 most frequent letters (in descending order of frequency) E, N, I, R, S, A, T, and D =67.9% 


1-e. Absolute frequencies of single letters as initial letters of 9,568 words in German plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


D 1,716 U 550 Z 343 K 263 0 135 
A "T62 W 544 M 3359 P 181 T 106 
Ss 698 G 461 N 306 R 167 C 22 
E 686 B 460 F 280 L 158 ~Q 2 
I 581 Vv 408 H 265 J 135 


“SEOREL_ 


2-a. Frequency distribution of digraphs based on 60,046 letters in German plain text, reduced to &,000 
digraphs. 
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2-b. Digraphic kappa plain, German language =.0111 (I.C. =7.50). 
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10. GREEK 


—SECREF— 


l-a. Absolute frequencies of single letters of Greek plain text, arranged alphabetically, based on 65,986 


letters of text. 
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1-b. Monographic kappa plain, Greek language =.0689 (I.C. =1.65). 
l-c. Frequency distribution of single letters based on 65,986 letters of Greek plain text reduced to 1,000 
letters, and arranged according to their frequencies. 
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1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 65,936 letters of Greek plain text. Percentage of 7 most frequent letters in Greek plain teat. 


Vowels A, 0, I, E, H, fT, and 29 =50.6% 


High-Frequency Consonants N, 2, and T =24.3% 


Medium-Frequency Consonants P, K, II, M, A, and A =19.1% 
Low-Frequency Consonants I, 9, X, B, ®, Z, Z, and Y =6.0% 
7 most frequent letters (in descending order of frequency) A, 0, I, N, E, Z, and T =62.2% 


_1-e. Absolute frequencies of single letters as initial letters of 11,850 words in Greek plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 
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2-a. Frequency distribution of digraphs based on 65,986 letters of Greek plain text, reduced to 5,000 


digraphs. 






JAlalm|R{oOlajalAlMsoloyMl|E i ajalolea lal 
i { ec 1 4 Jet fe) a et N) 
pe i eee Pei ep eS): a es eS et ale 
Pe caper eee I eee) 
fee dpe cle Se MeL A Or ES eee oe 
SelB Fee ee ae eet 
ed rt nN 
qi oO oO © do MIM) oe aly 
& %) NR N) Ns) S N 
Ns) nN YK rd | s) RN MiQyd wy 
1 | nN é \ re «0 a % v 
ePPPPlF S| ISIS Tar TT PRIS" PS 7a (S/T [5] 
RX wt rei et HIN afte ad 
| wt iO Yldajalhy]o | & N 
19 nN eo oy R | aa] N 
é MiNnil( TT iM lolaAlo TON TT Mayo 1 
VYLMO) ATR!) st O}]lIO TR 
Ped cape eee tee eect urea Sle veal 
qo 
N oH od/lM/lo[ 4s rc al ™ Te) rt oO 
ET SIS ee Py eee Py ey ey Te 
OY Ny) o> ale Xj °o lO Nlo;sA;w b 
d NX ct RN rN a 
nN ri Vp rN N %) qa a 
ISTE ey Pere yey fal TS) feet PPh ery | 
o - NN] 4 eo Oo MN] tO at 
qd a x qd nN 
wD HORM iAldal A MIAN ial;v Olaj» VPN TR 
& xt} 0 Alas] RN div] 
a one etfs dee pelea Re ee Ud let 
ele lals |S llalal@ tae (e er faislefe [se [s| 
rt ad NLR nN a 
ee Te ee Ue TE eee aise |e 
& Te) wv OO ns;olsel]Mo wey oO HAl/TIO;NA]a 
ed ot AIN/Alel|tlo Nila dq a 
it st St faite fat et erst fet | 
qd qd qd nN i 
eet een Wiles Weise si. 
eo a 
Pl sed lata fet ere eee | tec) cle es] ta 
tet eee R 10 CIS Sle Tesi bBi&lajada 
ajrife ad eiANl{ Ms NM PM LR 


~amMmMnea dt NH OH MM K SBS aSAWORARH HF Oo eK eG 








om P > TT © XY Q 


4 
= 











A BT A EF ZHoOIkKA MN 





4.61). 


2-b. Digraphic kappa plain, Greek language=.0080 (I.C. 


582 











11. HUNGARIAN 


“SECRET 


1-a. Absolute frequencies of single letters of Hungarian plain text, arranged alphabetically, based on 


50,787 letters of text. 


A 4,579 
A 2,016 


B 
Cc 
Cs 


937 
198 
223 


D 1,057 


QQ" Eh by 


Gy 


H 


5,414 
1,837 


3591 


1,261 


692 
889 


Ge 


iv 


2, 


2, 
3, 


427 
229 
667 
557 
158 
220 


M 1,738 | 0 ALT 
N 2,626 | P 489 
Ny 309 | Q ale 
O2,178 | oR. 2,261 
6 447 |S 2,049 
6 503 | Sz 1,056 


T 4,277 
Ty 3 
U 521 
G 111 
Us «394 
U 62 


1-b. Monographic kappa plain, Hungarian language=.0523 (I.C.=2.14). 
1-c. Frequency distribution of single letters based on 50,787 letters of Hungarian plain text; reduced 
to 1,000 letters and arranged according to their frequencies. 


Ehime owtH 


US QNE 


Sz 


B18 P 10 
H 18 0 9 
Gy 14 0 8 
J 13 U 8 
U- 10 F 8 
6 10 Ny 6 


{i 5 Zs 
Cs 4 Y 
Ly 4 W 
c oA Q 
G 2 Ty 
Ga “3; 


V 1,082 
W 13 
Y 15 
Z 1,271 
Zs 22 


SR OR ORO RS 


i-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 50,787 letters of Hungarian plain text. Percentage of 11 most frequent letters in Hungarian 
plain text. 


Vowels E, A, I, 0, X, E, u, 6, 6, 6, U, 
High-Frequency Consonants T, L, N, and K =24.8% 


Medium-Frequency Consonants R, 5, M, Z, G, V, D, Sz, B, H, Gy, and J =29.5% 


2 


i, 


G, U, and Y =42.0% 


Low-Frequency Consonants P, F, Ny, Cs, Ly, C, Zs, W, Q, Ty =3.7% 
11 most frequent letters (in descending order of frequency) E, A, T, L, N, K, I, R, 0, S, and 


A =66.4% 


j-e. Absolute frequencies of single letiers as initial letters of 8,180 words of Hungarian plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


SHDePAS 


724 
665 
636 
513 
507 
469 
372 


Hwy HM 2 Bh 


329 
501 


Z R98 


275 
253 
250 


nNnouanvr 


215 
188 
169 
152 
148 
134 


Cs 132 G 
A 100 G 
0 66 Gy 
U 61 ) 
U 52 Ny 
U 50 E 


ys O OorN 
ro 
re 
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2-a. Frequency distribution of digraphs based on 50,787 letters of Hungarian plain text, reduced to 
§,000 digraphs. 


e 































































































AABCCDERFGGHIftJIKLLMNN, ee TT UGG UV WY ZZ, 
A [12] 3/1 5171 S| 315] el22|10l16|__jio|42i4el [sel4el_2l 1 3411/14/51 
A pe ererar alata bel | a atl siusel at eueol (TTT tess anol 1-1 Tel aL 
B ea ane Tt eal a) FT fant apa te a ta 
c ee eat si ee ee ea Pols ls eel ate al 
c,| 4] if | a oe eee eae) ae op een eee) = toe Th Jane hada 
pi 7 sal [| ile7jel ar | Ty ef 7 3{ al aj fT | al a} fs} ej 4 ey | 
E Pot af al af viet af ef sisahialiel of | elsetreiuoiseloel ft | f fal ta 
Bil | 1 1 SegeL ah 48| 6| 
F lees Lif at [| [et | 
G Palast aff af ial | 
G, [2a] | ae ea a ae 
H fede hs) eee de de lied 
E | 3 2f 7[zo[ [af ef af [el | 
tte Petey sl ioc 2 
J [14/21 Perales ee ee 
K [35 5 5] 3] 1] 2i3si.el 3] 1] | 524{ if 2fia| al [zo] 4] 126] 3/17] 1] 2) | | 
L [4017] 4! [2 7l6ol1s[_4] 4) | 5{12) af efi2jea] fii s[ [27/7] ajo] aff 2] 2 
Uy ek Tha ot) lor te pte tle eed ds el dal a oder he bok ole 
M [32iie[ 4) J af f4zfza} at [-ajeif if if a) af [af ap aay aff Pet fal Pal 4h [ef ap ay apa) tf ay 
N [sal 4] 4] 4] 2i2el4ojia[_4i 7 if [24f if ite] 3[_ [4] si ef a] [3] af aff af 4] leo) | ef af if aj 3) [fd 
WCB oy Pepi ke | ep dle | ab all Pol fon |. fled) a OL oh ep 2. eel 
o(a [efapa al | { [sii7 a] [ | [alee] sf cleat af | TT [ay feelza[_afesl TT TT asf | tay 
Oa Tal oer ia aap ay sirol ape eye ee ms ey af Pret fea 
6 fat tat ta tt taal Pata tt ta tie Tt tt et tS 
oA Tf apay failare Papal TT et aa a et 
P RC pata Par ara otal Te a a et 
a Bates eee erie ee 
R eats aaa otal at a aot Tare at pal pata abel at Paar alek Tabet ata Pat 
s Toes et Lil aeseet ara i et of at ef of fof at fst aps sal al ela] T3Lij 4 feat 7 | 
S,| 8/14) | Pe nee teat |_| Pata} ap ay fal | ter ay ay Pa 
- ase 7, a Bt Terms) BI wel | 6/44) [sf 2] 3) 1 : 
es Mah ol alitie beak 2 fe ebb the. otis Bow [ep ales fee ee be one al Be foals Ps plea ip aah cls eo 
UE at | SBC a sheaf ue She te ke de ta ly de 
Gilet al 3 eed bol Noein fa 
uj PEER CCE ra rapa 4 — fs eee | 
U teal-+-+1 Stal . HH fa ta La} | ee eee te 
Vv | 2aze2]_ | | | is | Ppt ft a tt 
We tee ho ep le ete oe ee Seah ae shea 
eT ele hes bladed ob alee |e feds BE ro 4 fees Ae) fon escalates 
z arta ft foes ef fa fal t fatal Sst fat at ost ta pa ft 





a 
- 

















2-b. Digraphic kappa plain, Hungarian language=.0043 (.C.=7.28). 


12. INDONESIAN 


NOTE: C and V are exclusively found in words of Dutch or English origin. F is used almost inter- 
changeably with P, usually in words of Arabic origin. Q and X are used exclusively in words of occidental 
origin. Y is sometimes, though rarely, used for I or J. In the present text, however, it appears only in 
words of English origin. 2 is the sign of reduplication, either of the whole word or its root. W is used 
mostly in words of Arabic or Japanese origin, though it is sometimes used for consonantal U. 

l-a. Absolute frequencies of single letters of Indonesian plain text, arranged alphabetically, based on 
56,658 letters of text. 


A 10,828 F 83 K 3,166 P 1,794 U 2,459 2 331 
B 1,383 G 1,994 L 1,740 Q 6 Vv 40 
C 94 H 1,332 M 2,385 R 2,'750 W 254 
D 3,082 I 4,073 N 5,670 S 2,085 Y 11 
E 4,968 J 1,542 O 1,277 T 3,299 Z 7 


1-b. Monographie kappa plain, Indonesian language =.0833 (I.C. =2.17). 
1-c. Frequency distribution of single letters based on 56,658 letters of Indonesian plain text, reduced to 
1,000 letters and arranged according to their frequencies. 


A 191 K 56 S 37 B 25 Cc 2 Q 6 
N 100 D 54 G 35 H 24 Foi 
E 88 R 49 P 32 0 23 V @ 
I 72 U_ 43 L 31 2 6 Y @ 
T 58 M 42 J 27 w 4 Z @ 


1—d. Percentage of vowels, high-frequency consonants, medium frequency consonants, and low-frequency 
consonants in 56,658 letters of Indonesian plain text. Percentage of 4 most frequent letters in Indonesian plain 
text. 

Vowels A, E, I, U, 0 and Y =41.7% 

High-Frequency Consonants N, T, K and D =26.9% 

Medium-Frequency Consonants R, M, 8, G, P, L, J, B and H =30.0% 
Low-Frequency Consonants 2, W, C, F, V, Z and Q =1.4% 

4 most frequent letters (in descending order of frequency) A, N, E, and I =45.1% 


1-e. Absolute frequencies of single letters as initial letters of 9,209 words of Indonesian plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


D 1,532 S 795 J 344 L 141 E 33 
M 969 A 447 R 240 N 126 Vo 13 
K 893 I 418 H 2354 G 66 Q 5 
P 893 C 393 U 190 F 47 Z 3S 
ay 837 B 348 0 170 Ww 46 Y 2 
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2-a. Frequency distribution of digraphs based on 56,658 letters of Indonesian plain text, reduced to 


§,000 digraphs. 












s Pa ae ee Saal 
Ny Reese eee ee eee 
Hetepep ae ett el ate ee op tes 
elol | {isl tfelet ter tT eh TE 
ipa sche wen Renee 
Dlolo 4 wtlela}o]o tlalolo|m qd 
ed ded aAidietie ct Hi Qi wy 

«ial (qslal_l iris: lieleielels| [slelsfa; | Tt P| 
[0 ed fed \ to a rt et 

aes ee E feje iss) 

Faia Oe Ga 

© 

ele) ee ee 





al nN Aled 
Bl} ho | SY Qlalasolt/Mm/r/wso; Vi Dio} we Olas} ov} 
xt ray ad Yl eiayalw iti st | 
ei) ea ee eee eres Sree os 
wo ci rt NM) a ci 
Siete rel ea eb eee | iets 
ae S| ems aie se ee lee, ae ls 
eo a qd 
<i 1D elolt Hilo eo 
nN NR 


AMoaAanhkOMDHA MY ERZOKAOMH ED > FE HN A 





7.50). 


2-b. Digraphic kappa plain, Indonesian language=.0111 (I.C. 


586 





13. ITALIAN 


NOTE: In all calculations, accented letters have been combined with the corresponding unaccented 
letter. 

1-a, Absolute frequencies of single letters of Italian plain text, arranged alphabetically, based on 57,906 
letters of text. 


A 6,771 G 1,168 L 3,592 Q 2eT V 1,024 
B 527 H 493 M 1,441 R 4,037 W 13 
C 2,367 I 6,568 N 4,094 S 2,967 xX 9 
D 2,258 J 18 0 5,022 T 4,139 Y 14 
E 6,784 K 28 P 1,616 U 1,547 Z 527 
F 655 


1-b. Monographie kappa plain, Italian language=.0745 (1.C.=1.94). 
1-c. Frequency distribution of single letters based on 57,906 letters in Italian plain text, reduced to 1,000 
letters and arranged according to their frequencies. 


E 117 R 70 P 28 F il K 
A 117 L 62 U Rt B 9 J g 
I 113 Ss 51 M 25 Z 9 Y g 
Q 87 Cc 41 G 20 H 9 w g 
T 72 D 39 Vv 18 Q 4 xX @ 
N 71 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 57,906 letters of Italian plain text. Percentage of 8 most frequent letters in Italian plain tect. 


Vowels A, E, I, 0, U, and Y =46.1% 

High-Frequency Consonants L, N, R, and T =27.4% 

Medium-Frequency Consonants, C, D, G, M, P, S, and V =22.2% 

Low-Frequency Consonants B, F, H, J, K, Q, W, X, and Z =4.3% 

8 most frequent letters (in descending order of frequency) E, A, I, 0, T, N, R, L =07.8% 


j-e. Absolute frequencies of single letters as initial letters of 10,481 words in Italian plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) ; 


D 1,381 L 500 T S37 Ui 217 J 13 
C 1,041 R 4035 G 333 Q 172 W 9 
S 885 N 396 F 298 B 153 K 6 
P 830 EB S74 Vi 263 H 69 Y 3 
A 822 M 371 0 235 Z 29 x 2 
I 685 


2~a. Frequency distribution of digraphs based on 57,847 letters of Italian plain tezt, reduced to 5,000 
digraphs. 


B C DE F @H ZIdJKOL 
19] o[se|aifafielea[ apis] | fr 
=o} 7} |} a]_|_. pe 
s2| [iol [eo] | shs5 | 
si| | [Jes] [|_|] 
25| 7|si|Bs|i8| 6|2| 2)25| | 
Capa [hal 


= 
4 
° 
bar] 
| 
n 
q 
Ga 
<4 
=a 









a> 







oO 


24/78 
es 
co 
| 


[8] [eH 3 
El 
oi 






A 












ios he 
a] |S 
8 
w 
He 
° 
LE 
= 


a 
oN 







ae ae 
20] s|2ojasja5|i5|26/ | | | 7 
be SRR neee ae 
oe ae pee aal adele 
| 4{ 2j2z| 5/3] 3] ej15| 7] 5] | | | 
[4] fasfas} | | fT tat | | 
| 2|10}60| 4[ 5] 2jzajes| a] 4) || fa) 
2aje6| 4|25| 2/55] 40}24| size] | | | 2| 
| | feeja2} j2s} | tt tT tT | tT 
edd the dll eT Re sd 120t srecl e 
64| 1] af ef71] af 7] feos} | | ais] 9j45| 2] [iz] ejiefio] 5] | | | 5 
ao] fas] r}saj 2] [fas] | fats} f25] 0] | jsajseiz2] a] | | | 
es| [if jes} aj { jee} | [tt fajse] | fas] afszfao] | | | | 
v2] 2] a] sirs] 1] 5] fro] | |e] siea} ale] | sfatfas) [| tt ta 
ze] | | fest | ft les} | tT of tT fet tT fatet | | | 
ERR ERA ASS eA ee 
Se ee eS ee ee 
fee a Pe cle en Ieee ee oct lon Ne he Ne ein a led cake wd 
SAL LEE 


2-b. Digraphic kappa plain, Italian language =.0081 fe C. =5.48). = 







alelaler| 
we 
ae) 


hss|_| 
r|i5|6|s0] @|az | 3]s7 
7|-ale2|27|20] 520 3] 20 


a] 


HINT A] ® 
VJ Rr) w 

ol 

wa w 


zt Ie 
w 
w 
Scale 
hw 
ad 

ay 

niyo 
















eee ee ee 








14. NORWEGIAN 


NOTE: The letter Q is derived from foreign words in Norwegian plain text. 


1-a. Absolute frequencies of single letters of Norwegian plain text, arranged alphabetically, based on 
56,190 letters of text. 


A 3,228 G 2,211 M 1,841 S 3,572 Z 4 
B 739 H 830 N 4,666 T 4,497 AL 154 
c 20 I 3,298 0 2,702 U 718 g 505 
D 2,714 J 487 P 846 V 1,505 A 957 
E 9,119 K 2,077 Q 1 W 5 
F 1,287 L 3,043 R 4,813 Y 351 


1-b. Monographic kappa plain, Norwegian language =.0712 (I.C. =1.98). 
i-c. Frequency distribution of single letters based on 56,190 letters of Norwegian plain text reduced to 
1,000 letters, arranged according to their frequencies. 


E 162 A 57 M 33 B 13 c Oo 
R86 L 54 V 27 U 13 Ww oO 
N 83 D 48 F 23 6 9 ZO 
T g0 0 48 A 17 J 9 Q Oo 
S 64 G 39 P 15 Y 6 
I 59 K 37 H 15 A 3 


i-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 56,190 letters of Norwegian plain text. Percentage of 8 most frequent letters in Norwegian plain 
text. 


Vowels A, E, I, 0, U, Y, A, @, and Ak =374% 

High-Frequency Consonants N, R, 8, and T =31.2% 

Medium-Frequency Consonants D, F, G, H, K, L, M, P, and V =29.1% 

Low-Frequency Consonants B, C, J, Q, W, and Z =2.3% 

8 most frequent letters (in descending order of frequency) E, R, N, T, 5, I, A, and L =64.4% 


1~e. Absolute frequencies of single letters as initial letters of 11,678 words in Norwegian plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


S 1,233 Vv 669 I 367 R 184 Woa4 
D 1,099 M 646 P 340 J 76 Z <2 
F 922 H 637 N 322 G6 55 Al 
E 853 T 562 G 287 KR 34 
0 712 B 483 L 278 Y 8 
A 677 K 420 U_ 207 Cc 6 
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206-687 O - 77 - 38 


bution of digraphs based on 56,190 letters of Norwegian plain text, reduced to 


rh 


2-a. Frequency dist 


6,000 digraphs. 





eC PR Cees ele. | sles) er es 
= (Sis(s els eis le( teleport eee ep iam lel 
|] 00 alalea 
etal | felef|=[ [sl [sisfelafel=| [elaisiaie) [tt ele) 
ate { (slel [sl lal [sisleralelet fsisielele| Ts] T [a] 
“{ele] [sfeseiet feycieisiet le isisieiat it [sais 
of eee cela a dans | 
ae aL pe Pete eee ESS lee te Pe 
elale] fe[elsirieie(siaiailalal| lalalel jet | ft | tel 
fel eee) eee eee es ere eh es 
ee Se ee ee eae aired ee esac ae 
See Bec ee el ee Sieh Tah ios 
eee sic le ees ela eleh pel [ele 
fil ap) eee Se ete Dee ee ea 
| 4 o 
rt RN] Rj oO; Ait iwt} alr O;lo}]s © ) 
mfet Tsfaleloieled felsisiaiiet lelstal tel tL tL | 
pees Peery Se) Se eae ie ees ST ei a a Se [cise 
4 ri 
ri | LO fee) Yin ib MIN a Alin Nn iM 
eee ele) asleep ep pepe 
es Tee Pea ace a cal See tL ed 
id eo | a 
nla 9 tlolof[Hlolalvlo|/+io ala ei <! st! 
nN a oOlalalmflmMo]{wo}]ols a O® | oO 
ri x 19 etalon; oalola na mj n nN 
rol wv Rr i vt wD re 
FERRER ERE RAE 
eel PP LS ley ope eel ie ease ee Dh se 
rd a 
el ole WOlO/MININ/RlO;ela a/NIAXl oO 
did rps Nl Rl~atea im rc 


AMmoaAHk OMHHA MABE ZoKRCTHHRE DE EAN KX wee 











ABCcCDEFGHtIJs kK LM N- 





2-b. Digraphic kappa plain, Norwegian language =.0087 (I.C. =6.82). 


390 
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15. PERSIAN 


l—a. Absolute frequencies of single letters of Persian plain text, arranged alphabetically, based on 56,822 
letters of text. 


19,186 | ¢ 765 | 35 173 | 1,090] &€ 909 | S 484] 5 3,612 
+ 2,258 | © 167 | » 4,910)" 376] & s7 | J 1,681 | ¥ 4,263 
+ ai77 | ct 498} 5 1,009} * 259] 822] ¢f 3,319 
=~ 2,929 | t¢ 7ae | 5 13 |b 492 | 56 1,026 | wo 3,747 
eb 41 | » 3,997 |~ 1,478 | & 160 | S 1,534 | + 3,102 


1-b. Monographic kappa plain, Persian language =.0713 (I.C. =2.28). 
l-c. Frequency distribution of single letters based on 55,322 letters of Persian plain text, reduced to 
1,000 letters and arranged according to their frequencies. 


i166 | s 65 | J 30 5 18 |t 9 |w¥ 3 |e & 
» 89 rF 60 | S 28 e 16 |b 9 | 35 S|S 
ee OT eo 86 |uw 27 |s 15 |S 9 |e 3B 
4 72 |e 53 | 20 Cc 14 lw 7 |b 3 
o 68 | 40 | 6 19 € 14 |e 6&6 |e 2 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 55,322 letters of Persian plain text. Percentage of 9 most frequent letters in Persian plain tect. 


Vowels 1,4, and 3 =30.8% 

High-Frequency Consonants 4, 4,0, f, 0, and ~ =39.8% 

Medium-Frequency Consonants’,J,5,07,%,5, 5,€,.8,T, and € =24.1% 

Low-Frequency Consonants T,b, 5°,v7,",5, €.b,&,e, and 5 =5.3% 

9 most frequent letters (in descending order of frequency) ! ,4,%,4,0,9,°, 0, and~=70.6% 


1-e. Absolute frequencies of single letters as initial letters of 13,798 words of Persian plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


1 2,650 wo 810 6 314 c 202 w 124 J 71 5 8 
P 1,381 « 673 wm 291 £173 @ 113 & 22 ew 95 
w~ 1,341 2 585 a. 272 G 168 $ 105 - 21 
» 1,056 ct 444 G 251 Y 158 5 84 J 21 
S§ 814 we 390 SG 249 S 142 a Th a 11 


591 SECRET 


~SECHET— 


2-a. Frequency distribution of digraphs based on 55,822 letters of Persian plain text, reduced to 6,000 
digraphs. 
ae beve tt Ett y5 7 jb re bbe iggy SSI ty D4 2 


aaniil 

2 19(117 

ua 2 age 14 
|_4 eases bat eshte 


eee tata ieee 
REE Ee ae EEE EEA Ht atthe 
pe Rs eta 
| [ay TT Pa Tapa pet fap tT a ey ett a 
BCRCC CCEA ars 
| 2] 4] fis] [52] ay 7 ay ay Pt 2] ay af 2fial 4] elisieelaclao 
ae ete eed Te hot Meee ke pe dae 
[7 2] fa] 6] 3) 2f 2] | 3] fis] fie) 4) 3 
pS te 
SAR ae eee 


















































BC rat hr ish te 
Ga BR REE a CO We Se A ie ey i MC DP 
EtG Ha 
st Pei ber pera sah rea a 
Pts tT tt tt pay ep  e  T et siies7, 
|_| | BPH EECCA 
| ay | 3 2] | fa} | 2} 2] 2} ui 4 5} 3] 8] 6 8 
AS] 9[ 21/13] | 6] 1} 6] 713] 4/26) 3] [20] 6] 2] 3} 4) | 2 16|1 0/56 
4zii5| 2il4] | 3| 2| 2 vet | 9] ef [of 6] a] | tl ef 3 | witli) [s7[tifisiisi2i | 
|6giis} 2i10| | 3] 2] 2] S29] eo] 3] | slop 2] | ay | ey fll 7] 2] 1s4[tel [is] 9 
shat oat aan sere Ta saat ruok Tatol a apeael 2 




































als 
lalels 
aL 00) 
tl col 
Pliofen 
Eafe 
Sila 
Plo 
‘019 
a8) 
mo 





Slo 








ele 



























2-6. Digraphic kappa plain, Persian language=.0065 (I.C.=6.66). 
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16. POLISH 


NOTE: The letters Q and V are derived from foreign words appearing in Polish plain text. 


l-a. Absolute frequencies of single letters of Polish plain text, arranged alphabetically, based on 58,845 


letters 


of text. 
4,695 E 4,232 J 1,362 N 161 S 2,414 Y 2,146 
582 E 558 K 1,776 Q 4,314 S 264 Z 2,906 
"753 F 164 L 1,125 6 542 T 1,872 Z 489 
2,330 G 46 z% 900 P 1,789 U 1,035 Zz 39 
189 H 675 M 1,309 Q 1 Vv 4 
1,902 I 4,323 N 2,980 R 2,541 W 2,727 


1-b. Monographic kappa plain, Polish language =.0528 (I.C. =1.80). 
1-c. Frequency distribution of single letters based on 58,846 letters of Polish plain text, reduced to 1,000 


letiers 


1 


and arranged according to their frequencies. 
A 87 W 51 i 735 u 19 EB 10 N 3 
I 80 R 47 P 33 £17 0 10 Zz @ 
0 80 S 45 K 33 B 14 Z 9 v @ 
E 79 C 43 J 25 G 14 s 5 Q GC 
N 55 Y AO M 24 H 13 & «a 
Z 54 D 35 [,- Bi A ll F 3 


~d. Percentage of vowels, high-frequency consonants, medium-frequency consonanis, and low-frequency 


consonants in 58,846 letters of Polish plain text. Percentage of 4 most frequent letters in Polish plain text. 


Vowels A, I, 0, E, Y, U, A, E, and 0 =41.7% 

High-Frequency Consonants N, Z, W, R, S, and C =29.5% 
Medium-Frequency Consonants D, T, P, K, J, M, and L =20.7% 
Low-Frequency Consonants %, B, G, H, Z, S, ¢, F, N, Z, V, and Q =8.1% 

4 most frequent letters (in descending order of frequency) A, I, 0, E =32.6% 


i-e. Absolute frequencies of single letters as initial letters of 8,451 words of Polish plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


422un'U 


1,196 Z 521 T 335 C 254 U 160 F 54 Lh 4 
729 D 500 R 283 A 213 G 142 E 33 Z 2 
626 0 436 M 275 J 215 I 118 S 32 A> ah 
606 K 391 B 265 Z 179 L 108 H 21 Y 41 
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2-a. Frequency distribution of digraphs based on 58,846 letiers of Polish plain text, reduced to 5,000 
digraphs. 







ee 





Lal_| sis5| ee7, | [el ef | aleei2iieleciesisa]_9] 6| Teol [saleal_e2les 3i|_[i7] 8] 1 
pr pehol ata tba pat Pa Paaper at Pal ate Paral aa 
Tit tea Tt ts fiat t far yy fat top ay tar tsp a 

Para Tet at ensrat tt Tata Tabata Cat tata tee 
pot te Lit [ [Tt Papel fay teal tT tat tala fap fat 

SL 3| [| 2atay Tt ft af af al ef 3] 2jz5] [se] 3] 3] | of a] tile, | 4 sisa,_ [2 
3|_|7[24] ize] i] |_2les|_ | 4/35[islis| 2j2si3e] 5] 6) fis] [s2isi) fii] 3] j2et" [20] S| | 
[pia iol | ay Palast Py 4 el Te aay st a a 
Pate op ep | he oleate leg Pade os eid epee) ee eye ane ee 
ta} ai fi tae ft a eta fa ee aT fo Tt Pet Tal tT i 
14 (33a, [ei | fa ay [at 2] af af 3 2] sf [of ile [aj sl [ater [ea ai a | 
47{_8{ 2[27| aliojis2i26{ 1] 2] | 4| 4[2il 6] | giz] fiat [isi | Site] i] 9[ 6| 24) [9] of | 
Leis] i] 3{_{ 32a] 4{ af if [273 3} a, 3] 5) | a af at fetta] fot at fat 
| 3} Le}; tat fet ft 45 fat af 2] af if [33] 6] af 22] 4] tet et | et Tal 
eet if aj aj | fas] 2] fay fea} | 5} | | Choy [st | | | f4] [ae fay tT 
ES) a eee ne 
[a3] | 2] 2t [| 2) 3s} | | | f35| 2] 2] aj [al 4) fist 4) ef [at 3] [tl |_| 3 5) 2) a 
pels — speach aa ee ee ee eet Lees tt 
raat tat Pa a aatsast eet otal erat 
et ee eh ed a |_| ito} {| {4 es, | tal 
PERC re rata mest ar rat 
ee LN Ve WM eo eMedia eye | ke 
aa fal fae Pat Pata tata eat at taal faa 
do] 3| [el | | papa BOL LE ETS BLA 
BAER CCC CEL ECHL a A eal eles | 
BSCE ROMA et RBRIL a at at aT ees 
Heats tla bee ee eS ae | aa 
aCSt at et aet Stay a} estat SL aL sete eet Sto PBE a BLaT ct BIeat BT 
Lal | sel ste] | | aj 4] | et ote] 4] eltsjia] | 4} Tae] | jie] aio] af [24] [al 5 | 
4i| | 4 6] | 554] 3 | ei [23] 4] 6] af aiielisy fiel i) 6) [2 al | 4/5) frolsg] a] | 
sat fae fT tata ta st a er a a 


























a 






fe 






eye 





ao 










Patt 





a 



















ale 









SR Ga ESE Ta ERISA ech eet elas 














aot 
at 


2-b. Digraphic kappa plain, Polish language =.0055 (1.C. =6.36). 
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17. PORTUGUESE 


1-a. Absolute frequenctes of single letters of Portuguese plain text, arranged alphabetically, based on 
45,106 letters of text. 


A 5,362 G T24 L 1,245 Q 348 Vi ‘737 
B 470 H 304 M 1,699 R 3,292 W 24 
C 2,285 I 3,314 N 2,912 S 3,409 X 166 
D 1,900 J 160 0 5,001 T 2,679 Y 22 
EK 5,441 K 17 P 1,377 U 1,491 Z 207 
F 520 


1-b. Monographie kappa plain, Portuguese language =.0746 (1.C.=1.94). 
l-c. Frequency distribution of single letters based on 45,106 letters of Portuguese plain teat, reduced 
to 1,000 letters, and arranged according to their frequencies. 


E 121 N 65 U 33 F il xX 4 
A 119 T 59 P 30 B 10 J 3s 
QO ili1l c 51 L 28 Q 8 Wii 
Ss 76 D 42 Vv 16 H 7 x, B 
I 73 M 38 G 16 Z 5 K 6 
R 73 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 46,106 letters of Portuguese plain text. Percentage of 8 most frequent letters in Portuguese 
plain teat. 


Vowels A, E, I, 0, U, and Y =45.8% 

High-Frequency Consonants N, R, and S =21.8% 

Medium-Frequency Consonants C, D, L, M, P, and T =24.8% 

Low-Frequency Consonants B, F, G, H, J, K, Q, V, W, X, Y, and Z =8.1% 

8 most frequent letters (in descending order of frequency) E, A, 0, S, I, R, N, and T =69.7% 


l-e. Absolute frequencies of single letters as initial letters of 7,058 words in Portuguese plain text, 
arranged according to their frequencies. (One-letier words have been omitted.) 


P 847 M 405 I 264 B 113 Z 14 
C 731 T 348 F 222 G lil W oil 
E 608 R 316 Q 222 J 92 K 7 
S 601 N 299 0 187 U TT Y 4 
A 597 VooeaT1 L 143 H 60 X 2 
D 506. 


595 — ECR 








2-a. Frequency distribution of digraphs based on 45,106 letters of Portuguese plain text, reduced to 


5,000 digraphs. 





pa 
ey | aa I Sp Te ae : 
SEE EEE EEE EEE SHH 





2 CUECCCECCRRF RCD 
sfalals| >larayeley Tole a as aba 
eC FICOLL Pais) Teo eT 
ee ee 











See See eee ee 
a i 
| 4 EE 
|_ [58 , ase 
| [27 
mE | ri 
Es 
|_| 3 ha 
| [2 
|_| re 
fe ic 
| 9|2 | 2|24 
hi ae 
sae 
ee el 
7| 2 |46 8 
3| 2[2s 5 
mE Be 
4| 27 
mE ee 
|_| it 
| | 2 ei 
i ce 
| je 





x SEE CEECEEELEH 

R 
eae eas ete) tl ee tae oe ear el 
2 elie 
sisisla|s|s[elel=| [slals|slel-[slalalels| | 
PLE CaLCrelel Lele 
Ads] 
m 








el fet TT fst [eieleteley [etatoyet {tet ty 
Seb Ee sisalslel esas 


oA Mem UTM HHO MHS BOK OCOHKHNAD FP EF KM HN 


A B C DE F GH IJK LM N OP QRS TU iV W 


+ fsa fSopsy a 





2-b. Digraphic kappa plain, Portuguese language =.0084 (I.C. =5.68). 
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18. ROMANIAN 
NOTE: The letters K, Q, W, X, and Y are derived from foreign words. 


1-a. Absolute frequencies of single letters of Romanian plain text, arranged alphabetically, based on 
56,370 letters of text. 


A 5,143 D 1,933 I 6,251 M 1,628 R 4,279 U 3,261 
A 1,896 E 6,828 i 610 N 3,753 S 2,308 V 623 
A 337 F 619 J 124 0 2,627 s 685 W 3 
B 509 € 577 K 9 P 1,706 T 3,830 x 69 
C 2,883 H 146 L 2,655 Q 1 T 693 Y 3 

Z 381 


1-b. Monographic kappa plain, Romanian language =.0670 (I.C. 2.08). 


1-c. Frequency distribution of single letters based on 56,370 letters of Romanian plain text, reduced to 
1,000 letters and arranged according to their frequencies. 


E 121 uU 58 D 34 = ae B 9 xg 
TUT Cc 51 A 34 Vou Ze K ¢g 
A 91 Lo OAT P 30 F ll A 6 Ww @ 
R 76 0 47 M 29 Ty H 3 Y @ 
T 68 S Al a 18 G 10 a> <2 Qa ¢ 
N 67 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 56,370 letters of Romanian plain text. Percentage of 6 most frequent letters in Romanian plain 
teat. 


Vowels E, T, A, U, A, f, A, and Y =43.1% 

High-Frequency Consonants R, T, and N =21.1% 

Medium-Frequency Consonants C, L, 0, S, D, P, and M =27.9% 

Low-Frequency Consonants T, S, V, F, G, B, Z, H, J,.X, K, W, and Q =7.9% 

6 most frequent letters (in descending order of frequency) E, I, A, R, T, and N =53.4% 


1-e. Absolute frequencies of single letters as initial letters of 10,655 words of Romanain plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


D 1,168 M 467 P. STO V 239 Z 52 A 1 
Cc 1,167 N 449 F 369 0 200 J 31 Q a 
P 979 I 415 E 314 G 174 H 20 W 1. 
A 907 L 395 R 277 B 117 A 5 xX 1 
s 862 S 392 U 249 T 62 K 2 Y 1 
i 508 








2-a. Frequency distribution of digraphs on 56,870 letters of Romanian plain text, reduced to 5,000 


a 





See ee ese ae eee 
Bc ssl leap eee ee deel [ea 
Se 








SEC CURE CECLOEL RPC RCE EEE 
ee eye WP) Se ae eee Se We esha edt 
als[e| Pisisleielejist [ol [eigiei=|si ieiaiieieteisi [ey lel 
elaiel { feietsi {| fat ft feteieyet tee yet ey ey 
> BIS LER ISLCCSELLPRREECPSFELELLLLL 
OO ple I RENN Pekar les le edna ede ape) 
wt Teer eb ee et ete et le 
SE SR eee RGR Ree E aah 
<lafal fepeieleleleltei-t=| [eisiaialst [sjsieisfeisiet [ey fe] 


teqeq@ Mong kh OTHH NMA BZ OH PFT MHRA HY DPF FR HN 





2-b. Digraphic kappa plain, Romanian language =.0068 (I.C. =6.53). 





19. RUSSIAN 
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1-a. Absolute frequencies of single letters of Russian plain text, arranged alphabetically, based on 67,850 


letters of text. 


Be Wop 


5,122 
1,095 
3,543 
1,141 
2,076 
5,537 

502 


SAAS 


1,280 
4,923 

961 
2,524 
2, TAT 
1,936 


AYaQWHO 


4,463 
8,078 
1,815 
3,427 
3,917 
4,041 


1,578 
127 
941 
369 
902 
554 


HH he < 


1-—b. Monographic kappa plain, Russian language =.0568 (I.C. =1.76). 
1-c. Frequency distribution of single letters based on 67,850 letters of Russian plain text reduced to 1,000 


letters, and arranged according to their frequencies. 


QHmtsr eo 


B 5&2 
P 50 
Jt 40 
K 34 
QM $i 
M 29 


HE fa 08 pt ed 


B 16 
MW 14 
b 14 
x #414 
Yq 13 
m 8 


eORASH 
wap ay ~ 


iy 207 
BI 1,421 
B 960 
9 173 
io 455 
SH 1,185 


1~d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 67,850 letters of Russian plain text. Percentage of 10 most frequent letters in Russian plain 


text. 


Vowels A, E, Mf, if, O, VY, BI, 9, 10, and A =43.4% 


High-Frequency Consonants B, H, P, C, and T =28.6% 
Medium-Frequency Consonants 5, T, II, 3, K, JI, M, I, X, 4, and b =25.4% 
Low-Frequency Consonants JK, ®, If, I, and I] =2.6% 


10 most frequent letters (in descending order of frequency) O, E, A, A, H, T, C, B, P, and JI =67.5% 


1~e, Absolute frequencies of single letters as initial letters of 10,601 words in Russian plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


JI 1,210 
Cc 983 
H 800 
B 7351 
O 650 
K 555 


A A996 
M 446 
P 429 
T 418 
3 404 
B 344 


MW 321 

CT 292 

Y 229 

YU 182 

9 147 

JL 146 
599 


xX 120 
A 116 
E 92 
we 672 
ti 63 


BaRAH ® 








2-a. Frequency distribution of digraphs based on 67,850 letters of Russian plain text, reduced to §,000 


digraphs. 





is @EECEECPECCPFEREPERECCCCCCCELLE! 
Seve ye eee ale Oh ha ale Re ee ie 
Peele Wey ere tere ee ei se eee a 
Ae Se tere deel i tbeh st et 
eS te Le eer Seen ar a Nt a 
aoe eee eee ee aa eee 
Be ero de sa ree hs UVM ats TS Te 
ae ee deel dels else tae le ee er 
Bay a peels eee eT OU Pelee oe Pelee tat 
ee SS eh) ee eee ee 8h Te 
See wey ey ey Ee ee kck Leet de 
Pee Se ie Pie ee eee) a een es 
ell [et [let T fale iefeleral felaielet fet fet Ts pPloleist 
ofalelal [ele lalel[feleial-(e(alafsies| TTT felate{-[e| 
alge els else ee eer eee ae 
Slee eee eae ee Se PIE) dale res ee 
cfelataisial | fef@loigisists(ielsisisi|"ial=| [et isiel te] 
migle(ol=jeialeleisi=isjel isisielelolale [se] jeleie [sista (ale! 
ate lela) SiR eee) eee eee 
AS Se Pla ee el) ae nae et te ee 
aie eee) elaemio mee) mise ise ieee 
i ale po Sle ede ee ey 
meee lelefelellai=leleialaial*alelaie|s(*(sisislel tel [ele 
sie) Eels eee) eel ee ese ee 
BCI are ies IS ete EW Mere eat hee JOYE Th ee 
“ePisirialeiria) isis salieri 


US ee S| eee ee a Se 
<sfelelrfaleelel=|-islalaist i |eletst=|etieiafele| | tt le 


met 


AMM H ma Ro BHM RP BStontnveprpekX are Fao Qe 


2-b. Digraphic kappa plain, Russian language =.0052 (I.C. =5.00). 


600 


























mu 





20. SERBO-CROAT 


NOTE: The letter W is derived from foreign words appearing in Serbo-Croat plain text. 


1-a. Absolute frequencies of single letters of Serbo-Croat plain text, arranged alphabetically, based on 
61,915 letters of text. 


A 7,161 271 


Dj J 2,370 N 3,424 S 3,246 H 389 
B 847 E 5,625 K 2,283 Nj 509 T 2,541 G° 512 
V 2,467 Z 416 L 1,'750 0 S773 C 42 C S77 
G 1,122 Z 1,108 Lj 361 P 1,858 U 2,802 Ss. JST 
D 2,413 I 5,875 M 1,772 R 3,382 a Ww 3 


1-b. Monographie kappa plain, Serbo-Croat language=.0617 (I.C.=1.85). 


1-c. Frequency distribution of single letters based on 61,916 letters of plain text, reduced to 1,000 letters 
and arranged according to their frequencies. 


A 116 R 55 D 39 L 28 s 9 H 6 
I 95 S 52 J 38 G i8 a. 2 Lj 6 
0 93 U 45 K 37 Z 18 Nj 8 Dj 4 
E 91 T Al P 30 B 14 N 7 F 2 
N 55 v 40 M 29 é 9 é. ¥ w @ 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 


consonants in 61,916 letters of Serbo-Croat plain text. Percentage of 4 most frequent letters in Serbo-Croat 
plain text. 


Vowels A, I, 0, E, and U=44.0% 

High-Frequency Consonants N, R, 8, and T=20.3% 

Medium-Frequency Consonants V, D, J, K, P, M, L, G, Z, and B=29.1% 
Low-Frequency Consonants C, S, C, Nj, Z, C, H, Lj, Dj, F, and W=6.6% 

4 most frequent letters (in dencending order of frequency) A, I, 0, and E=39.5% 


1-e. Absolute frequencies of single letters as initial letters of 11,460 words of Serbo-Croat plain text, 
arranged according to their frequencies. (One-letter words have been omitted.) 


S 1,401 K 676 T 353 G 249 Cc 84 H 38 
P 1,250 J 527 B 338 A 184 F 78 Nj 38 
D 818 Z 437 U 319 ¢ 133 E 6 Lj 27 
N 760 V 436 M 314 § 119 Z Dj 23 
0 760 I 430 R 313 ¢ 116 L 66 W 1 








2-a. Frequency distribution of digraphs based on 61,916 letters of Serbo-Croat plain text, reduced to 5,000 


digraphs. 


sea ee Oe eC da ade eee a eee beat a 
po eee Coens SSR eee eee eee 





Behe desee et ie EA SIEM CS) IT Mie Vessels 


Oe ey epee eee ae a a ee 
Ce ee Re ORR e ee Ree eee eee eee aES 
SH 


oECERE CEL PEP EES PPPS Ris OCT 
“iplateisial [el felet [alt felt feist (sial feleiele| ff | 
“(at | fell fal iefaielett yet fal fester; [ai ist t fet | 
taleiatatel [al italPlelal (etal lolateeier ere 


SEEPSECELEECPLUPCCEPFISLLELELSEL 
“ist [a[atT fal fT fete(ety ist dst felelet tat iat ialet | 
see ee ate ee a aise 


Spee ee a ie ot ioe 
atet | teint [st [eiaieyat [fete ial [et fet isl dst tT 
ae eee a eee a 


«SSeS 2S) RED SEPP 


AOMPrPonaRAnNH OMA Dez Bon etnnwo De T OOM EF 


2-b. Digraphic kappa plain, Serbo-Croat language =.0062 (I.C. =5.58). 
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21. SLOVAK 


1-a. Absolute frequencies of single letters of Slovak plain text, arranged alphabetically, based on 46,026 
letters of teat. 


A 4,694 F 110 K 1,816 R 2,428 W 23 
B 810 G 124 L 1,892 S 2,238 x 12 
Cc 732 H 596 M 1,512 s 338 Y 1,343 
C A424 Ch 515 N 2,903 T 2,294 Z 935 
D 1,666 I 3,251 0 4,827 U 1,656 7; 349 
E 3,848 J 849 P 1,487 V 2,354 


1-b. Monographie kappa plain, Slovak language =.0585 (I.C. =1.70). 
i-c. Frequency distribution of single letters based on 46,026 letters of Slovak plain text, reduced to 1,000 
letters and arranged according to their frequencies. 


0 105 R 53 K 40 Y 29 H 13 G 3 
A 102 Vv 51 D 36 Z 20 Ch 11 F 2 
E 84 T 50 U 36 J 18 é 9 Ww oO 
tT S 49 M 33 B 18 7 <8 X 0 
N 63 L Al P 32 c 16 S & 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 46,026 letters of Slovak plain text. Percentage of 5 most frequent letters in Slovak plain text. 


Vowels 0, A, E, I, U, and Y =42.6% 

High-Frequency Consonants N, R, V, T, and S =26.6% 

Medium-Frequency Consonants L, K, D, M, P, Z, J, B, and C =25.4% 
Low-Frequency Consonants H, Ch, 6, Z, S, G, F, W, and X =5.4% 

5 most frequent letters (in descending order of frequency) 0, A, E, I, and N =42.5% 


1-e. Absolute frequencies of single letters as initial letters of 7,882 words of Slovak plain text, arranged 
according to their frequencies. (One-letter words have been omitted). 


64 | G 24 


wif Ue fees? 


P 960 Z 378 D 350 R 263 Z 110 S 
S 745 K 368 M 330 U 232 é 108 c 59 Ch 19 
Vv 602 T 361 B 313 J 144 H 108 F 54 W oil 
N 577 0 356 A 297 Ll. 27 I 89 E 39 Yo 
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2-a. Frequency distribution of digraphs based on 46,026 letters of Slovak plain text, reduced to 5,000 
digraphs. 


a 
orn 
N 


















2 


O1oa 
no 
OO} 0 


si feo] 6 [221 6| 


U 
De 


5 


PSSRRRRARROR eee 


Hl~ wv 
O10 o|;riN 
° 


et | 
fal TT Tals 


| 4| 2 
pad 
| 6 [ez 
| 
3] 


os 


real fel | 
wv b 
BEiwleta H 


ja 
nw nN 
oO WL at oal a Nl aoalpatr 


=f 


8 
Ww 


we 


wn 


| 2 5 
[4 fia 
2 hal 3 
29 | 4 


2 
i 


a) 


“i 
je] | | TSist 


| [afoot [fel Tt Tf 


ib 
ib 


Vf af e]@ | hoa fF btw 
POPP Re) OP RY Dw OP MLW A 


pan 
folwimtalefal [| 
bw 
tele [S| elo 


sw 
Ww 


3 
au eaes 
11 21 1 
repapapafesy [ap Bal a 6 2 
ais} a a[ ales) | fal ap af 2 af 6 5 
ss[ af ef af sleoh aff esl Vel af | als al 2 
zoel Tas] asa eae aielslel abrfafeol [Yala 
a OT Fa 
sala aisiet ata ial ele eielal a lalanreter eral a, 
FETSey [ele hel iselze[ af slielicl =| 6] fest efel f [al | 
CeCe Gat eee? Leary ce 
ssf) [fees a| Pa [bs] [ef-s] afsaleo| 2[z8] 3| Pehisfial [Papa] ay 
ol ae ee a aaa ala ata et oe ate ee 
2hizlael 6-7] spe] af] 2] | el 7) 
pe alesis ae delee oa e, 
se i Ol 
el al a] | ssl aps] aia] | _P fape 
el {Tale Lat fala sal <tetrlsta] s}apap ts] | papa 
Pie tebst tT het taka) Pett afar ah Coo 


2-b. Digraphic kappa plain, Slovak language =.0056 (I.C. =4.71). 


oO 
°o 
oO 
& 


eee ene eee 


R24 
44 


wn 


= LY) 5] 
AQPDWIP RIV) ON) Ale) re Ojr a OH 
i 


r ie] HNlwolr] 
fal E{molo[Blofole| [BLE[S| || 
fefrol [rtm] | |] fafelel | | 


BIW 
EEE 


ra 
= 


be 
xq 
fBletst tebe] 


12 


2 


8a 812 
| 








P| 81S 
BIN 
Bs 
[P| 


aw 


ES 
s 
a 
| 2 
[2 





i my yar ann r 











22. SPANISH 


1—a. Absolute frequencies of single letters of Spanish plain text, arranged alphabetically, based on 60,116 
letters of text. 


A 6,681 G 825 L 2,174 Q 346 Vv 602 
B 799 H 367 M 1,740 R 4,628 WwW? 56 
C 3,137 I 4,920 N! 4,823 S 4,140 x 127 
D 2,687 J 190 0 5,859 T 3,180 Y 413 
E 7,801 K 2A P 1,785 U 2,172 Z 182 
F 481 


1-b. Monographic kappa plain, Spanish language =.0747 (1.C. =1.94). 
1-c. Frequency distribution of single letters based on 60,1165 letters in Spanish plain text, reduced to 
4 1,000 letters, and arranged according to their frequencies. 


E 130 S 69 U 36 Vv 10 J 3 
A 111 T 53 P 50 F 8 Z 3 
0 oT C 52 M 29 Y 7 x 2 
I 82 D 45 G 14 H 6 W 1 
N 80 L 36 B 13 Q 6 K g 
R TT 


1—d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 60,116 letters of Spanish plain text. Percentage of 7 most frequent letters in Spanish plain tect. 


Vowels A, E, I, 0, U, and Y =46.3% 

High-Frequency Consonants N, R, and S =22.6% 

Medium-Frequency Consonants C, D, L, M, P, and T =24.5% 

Low-Frequency Consonants B, F, G, H, J, K, Q, V, W, X, and Z =6.6% 

7 most frequent letters (in descending order of frequency) E, A, 0, I, N, R, and S =64.6% 


j—-e. Absolute frequencies of single letters as initial letters of 10,129 words in Spanish plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) , 


P 1,128 L 435 Q 286 V 183 Y 27 
c 1,081 R A25 I 281 F 177 W 19 
D 1,012 M 403 H 230 0 169 Z 2 

: E 989 N 346 U 219 B 124 K i 

: Ss 789 ~ 298 G 206 J Ay W g 
A 761 


1 Includes N throughout all tables. 
2 From foreign words appearing in Spanish plain text. 


206-687 O - 77 - 39 
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2-a. 
digraphs. 





wy 
N 



























rR 


2 BB eee lL Pes le ee hee Mea (aS edo 
Bara eee oleae 
ee a es aoe ae 
| S{ aj sj2t stata | | tt papas} efapat sp afay | tt TT 
ae MN i he EE Te eee ae eae ade of |e aly 


Q U x 
a [12[14[54]e4/15| 5] 8] 410 [8] | 41] 30/64] 4]24] s|eifeztis[ 9] 9] | [11/4 
Bia} | | 15) [ | isi] fset | fs) fe; efits] | te 
c fast fs] fav; | [siso] | | a{ [ feo} | [el fasfel | | Tt | 
p sz] [fetes] | frlso] | | | [tfssf efi} sit fel | | fal | 
g |z0| 5|47|26/17| 8[21| 6| 9 | 3] | 44/26/18] 5/23] 4 [04] 19/17] 5 |10| 2] 8] 2] 3) 
Frat [ | te; | | pet tp at ft tat fT fet Tt fst TT 
@fze{ |] fet tT | fet | pat fepep Tap pape Py 
Hee h lpr geet i i se lsih aly eee so icy 
1 /43| s{4zieo/4o] 5] 8/ | [1] [14[16[soje7| 4] 1[iele7i2ai fel | [| 5] 
ila teh tee. Poe AR ees elite tigi ts gap. 
ee ees) eae ie sie ee [Pelee To EAE | Pa 
L (44; | 5] 5/35| 2] 3] jes] | | 9] 5] afz7] 5] 3) 2] 4] 5] 5] s) [at 
m [sejro} | jae] | | jsol | | | | fasjzo] | | | te] | TT 
N 33|37|41|10| 6| 2j28 [1] | 5] 4| 3/43[10| 2] alailorjie|6[ | [1/2 
0 2g|26|i6| 6] 5] 5| 4 [1] | 22/33/10] 4/29| 7|o8|7sla2] 3] 5] | 2| of 2 
p{so] [a{ fae] | | {5 | jel | fat | ist at shel | TT 
af | RE aol alte ee eet tee bal tce 
R [74] 1[12|zojoa| fae] [45 [2[ 3] 6/15[11/43[ 7] s[z0[10j25| o[ 6] | | 2] 2] 
s j32| 2[18|15j57| | 2| 4/41 |1| | 5] 7| sjez|26] 4| 6{1o|s7j2s/ 2] | | 4] | 
tjeo} | 2] Jez] | | je] | | | | jsef | is4p fT fet [| TT 
u BREE apa eee oe eee 
Vv 
W 
x 
Y 
Zz 


- 
o 


. Digraphic kappa plain, Spanish language =.0091 (I.C. =6.15). 
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23. SWEDISH 
NOTE: The letters Q, W, and Z are derived from foreign words in Swedish plain text. 


l-a. Absolute frequencies of single letters of Swedish plain text, arranged alphabetically, based on 
58,302 letters of tect. 


A 5,073 G 1,835 M 1,'749 S 3,400 Y 354 
B 697 H 961 N 4,784 T 4,694 Z ii 
C 612 I 3,059 0 1,938 U 854 A 938 
D 2,483 J 289 P 835 Vi 1,183 A 996 
E 5,401 K 1,'760 Q 5 W 22 6 828 
F 1,238 L 2,'7T49 R 4,512 x 44 


1-b. Monographic kappa plain, Swedish language=.0626 (I.C.=1.78). 
l-c. Frequency distribution of single letiers based on 58,802 letters of Swedish plain text reduced to 
1,000 letters, and arranged according to their frequencies. 


E 101 I 57 M 33 U 16 J 5 
A 95 L 52 F 23 P i6 x a 
N 90 D AT V 22 6 16 Ww — 
T 88 0 36 A 19 B 13 a 
R85 G 34 H 18 Cc il O>..23 
S 64 K 33 A 1s ar 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonanis, and low-frequency 
consonanis in 58,302 letters of Swedish plain text. Percentage of 9 most frequent letters in Swedish plain text. 


Vowels A, E, I, 0, U, Y, A, A, and 6 =36.5% 

High-Frequency Consonants N, R, and T =26.2% 

Medium-Frequency Consonants D, F, G, H, K, L, M, P, 5, and V =34.1% 

Low-Frequency Consonants B, C, J, Q, W, X, and Z =3.2% 

9 most frequent letters (in descending order of frequency) E, A, N, T, R, 5, I, L, and D =67.9% 


1-e. Absolute frequencies of single letters as initial letters of 9,603 words in Swedish plain text, arranged, 
according to their frequencies. (One-letter words have been omitted.) 


S 1,094 H 465 P 354 N 217 A 68 
F 766 V 433 I 304 G 188 Cc 25 
A TAL E 418 U 291 A 153 Y 15 
D 723 B Alv7 L 261 6 «96 W 10 
M 594 T 415 R 251 J 82 z, 3 
0 555 K 357 
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2-a. Frequency distribution of digraphs based on 58,302 letters of Swedish plain text, reduced to §,000 
digraphs. 


pooper oktsRtunoranssuyexys kid 















|» | 
w 
S| 
| 
n 
| 
n 


2 | | Jol | ci 


tLe 
| | | | fal fel at feo] | || a2 cs eer, 
| 2] | zum] a] 2) 2)aa] a] 2] 4] 2| vo} 2] ss] | fay fatale) 
eee eee 


wn 
Be 
| 


fof] [8 
a nN 
E 
we 
| 
nN 
fae) 
hs 


rS 

islals 
7 7 fe 
WwW} BR] ola 

S| lol [ol 

Oo 

[ele lal [ale 

P tefet [ele 

ro 

al mlool | 

nw 

Bo) 

fete foal | 


a7 








[=[ofo| ajo e 


o|ja 


[ro] | 
~ 
feel ol] 
3 
| 3] 2 | 
,uwo 
[=] 8} ro) 5 
en | Bee 
Me 
° 
he 
wn 
fal fo 
f+] [ol 


ee 





nw 
[|r 


0 
ol 
} 4 
ARE 
iN 
{9 | 09 


| 
lol =| 
el 


oO 
H 
jo 
alata] | 


: 
lol TE lalolale| 


or} | 





[efeol | | 


feafoafro! | 
Ww 
bb 
| ea | | 


Ww 
© | 
he 
ww 


2 
| |e] 
By | 
ele 
A 
nu 
re CA | 
rFIo]a 
fe [a | 

| 

o 

Mi 

nw 

a 

wd 

w 


2 






s|_[elals} 
eee 
iz 


eaiieion 
papal CCC 
Petes alte APSA aie fee lead eal 
7s [10] [2a|ae|12] 6|10/46{ 2[12[10/15|25|17/ 6| | e[solzs|1o| 8| | | 3] |r4|23] 4| 
j24| 4| 2| 4/25] 6| 1{ 2/22| s[4slia| 8| si26/ 3} | sjisise| 4/12] | | 5] hol 9| 4| 
[55 | | 2/20[e4]15] 6| 9[52/ 4| 5] 7|10/ efre] 5| zo[ss[er| ofr] | |e] | afol 4| 
ee See et ee eee ett 


ww 
1 rw] QO | 
A 
el al 
oO 
A 
nN 
“J 
© 





eae ee eee eee eee 
egal aaa 
ae healed 
















Ay | fapel fayet Ty fal rater tbat s+ | 2 fed Zee 
SCORE EC CEGEE ETC 


2-b. Digraphic kappa plain, Swedish language =.0070 (I.C. =5.89). 
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24. TURKISH 
NOTE: Letters W and X are derived from foreign words. 


1~a. Absolute frequencies of single letters of Turkish plain text, arranged alphabetically, based on 55,206 
letters of teat. 


A 6,303 F 339 J 27 6 276 U 1,698 Z 629 
B 1,408 G 614 K 2,360 P 431 U 923 
Cc 535 G 489 L 3,623 R 3,978 V TT2 
C 382 H TTT M 2,381 S 1,774 W 3 
D 2,296 I 5,314 N 4,015 s 975 x 1 
E 5,839 I 2,060 GO L;117 T 2,480 Y 1,387 


1-b. Monographic kappa plain, Turkish language =.0622, (I.C. =1.93). 


1-c. Frequency distribution of single letters based on 56,206 letters of Turkish plain text, reduced to 1,000 
letters and arranged according to their frequencies. 


A 114 R 72 K 43 U 31 Ss 18 Z il P 8 J Oo 
EB 106 L 66 D 42 B 25 U lv G iL CG 7 Ww oO 
I 96 T 45 I 37 Y 25 H 14 c 10 F 6 xX 0 
N 173 M 43 S 32 0 20 Vv 14 G 9 0 65 


1-d. Percentage of vowels, high-frequency consonants, medium-frequency consonants, and low-frequency 
consonants in 56,206 letters of Turkish plain text. Percentage of 6 most frequent letters in Turkish plain tect. 


Vowels A, E, I, I, U, 0, U, and 6 =42.6% 

High-Frequency Consonants N, R, L, T, M, K, and D =38.3% 

Medium-Frequency Consonants 5, B, Y, $, H, and V =12.8% 

Low-Frequency Consonants Z, G, C, G, P, ¢, F, J, W, and X =6.3% 

6 most frequent letters (in descending order of frequency) A, E, I, N, R, and L =52.0% 


j-e. Absolute frequencies of single letters as initial letters of 8,016 words of Turkish plain text, arranged 
according to their frequencies. (One-letter words have been omitted.) 


B 1,078 A 508 H 404 G 123 c 84 0 44 
M S71 5S 442 E 366 N 119 Z TA I 9 
i 565 T 434 Y 359 Ss 110 Uo =T2 J 5 
D 541 G 416 O 298 R 102 L 55 Ww 2 
K 513 V 409 P 148 F 97 U 46 
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2-a. Frequency distribution of digraphs based on 55,206 letiers of Turkish plain text, reduced to 5,000 
digraphs. 


w 
Q 












































A ¢ EFGGHII3IJIKLMNOGPRSSTUVUUVHWAX YZ 
a | 7[23]10] 3/30] 3fio| 7] sfis[ 9] | alsela2jesfoo[ 4] [11[so[zofis]24[ 1] ie | [e7|14 
B ee ae I ee Let 
c a | | fatto | ts} | tat ET ET stat | tT 
¢ al IL : at A) EARL ELE) 4 ER LGR 
dyes] | | [alee] [ | | fatis? | [| [ | Pela] fat T | pele) TT fp? 
| 8[18/15| 7/32] 5] 5[20/ 8] 8] 7| 1| 1/43/31)31/47| 4] 1] 3[99/34]11[62| 1] 1/16] | | 19) 4 
Fie | | | ts} | tt taps] | tat ETT st feta TE 
ciel | | { js; | tt festa) | | tT fT febol fea; tt tere] Tt tT 
G ate ahs RAH 4 | [| tz tt yt 
H | | @ 1] fatetat | | | feel [ef4tefal | TT 
Z| 6[17| 4[10[13] 4] 4] 5] 9[10/ s| [| [esje1[zifes| 3/1] s[7i[s0j26{ie/ [| 1| 4] | | 26[24| 
rT] 3{5{ 1) 2) 5} | 2) 2] 7] 3] 4] | [aelta] ofo7] 2] | fas] sii4) 4] [als] | | sl 
2 nase aceasta sea eee Sees 
K|4a] 5{ | 1| {191 | tfa7faa] | s{a4] 5{ fis] 2{ 1] 7] 4{ afaslas] sf 2] [ [ 3l | 
L ne 2 jos] | 5 eae 26} 1] 4{ [2] | 2| | jo] 3] 2] | | 2] | 
M 1| | Pts stata saat hss aE 
N eee Ss eee eee ee eee eee 
Oy eae a es SP | 87 ets) sa at st 3] | | ay 
Ol Pe ea ed ete ef eles eo ae a fk Bice 
Pjis} a] | [apet | | ftpits] | tele} [et 7 telat jsfat | Ty TT 
R {58|16] 2| 3|/26/37| 3] 5| | sle2i22| |rojisiis/ 4) 6] | 2) 3| 7] 4[islis| 6] 4] | |e 2 
s Past et LS St 1 pp eae Ee SeKe SH 
s{s{ si} [2] [s| [2] | [vel | 5} ej] [sy [_fvfetsi 3s} | Tf] 
T 42/3 ale “a 238 ARRAS EERE 2; | | | 
U 1} 5] fa 6] 2] 1] | 6]214/14/30] 1} | s}asjio] 5] 7/2) | 4] | | 3] 5 
BL] 2p 2} af ef att [apap at [fas] sire] | [at sf 4] ef st | [el | el 
vizzt | {| [jst | TT fet} pap ety TT et et at st 
Wee ee ee i ee Chee teed ole estate dad 
ee, EP eae ee See el ee ei eee Wc dba ede a fo 
v jas| a] |_| sjesf2}a) | [el 7] | af) spate) [ [sl | | fel sy Ty [a | 
zz2{2[2fr}stef [af feiiat |stats} fay Tt fal fafetayat | fa | 


= = = 


2-b. Digraphic kappa plain, Turkish language =.0065 (I.C. =6.25). 
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APPENDIX 7 
PROBLEMS—MILITARY CRYPTANALYTICS, PART III 


The problems in this appendix are grouped into ten sections, paralleling the sequence of the text, 
with. scopes as follows: 


Section A—Simpler varieties of aperiodic substitution systems 
Section B—Ciphertext autokey systems 

Section C—Plaintext autokey systems 

Section D—Systems with long or continuous keys 

Section E—Cylindrical cipher devices and strip cipher systems 
Section F—The Wheatstone cipher device 

Section G—The Kryha cipher machine 

Section H—Key analysis 

Section I—Teleprinter key analysis 

Section J—Cryptodiagnosis 


The portion of the text which should be read by the reader prior to solving the problems in each section 
is indicated in the section heading. 

This set of problems is also available as a separate publication in a loose-leaf book of ten lessons. 
This book, entitled ‘“Problem Book—Course, Military Cryptanalytics, Part ITI,’’ contains the crypto- 
grams which for the most part have been arranged in a form suitable for worksheet use, obviating the 
necessity of recopying; frequency distributions and other aids, where applicable, are also appended to 
reduce the amount of time spent on the purely clerical labor incidental to solution. 

* * * * * 


DO NOT WRITE ON OR OTHERWISE DEFACE THESE PAGES! 
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DO NOT WRITE ON THIS PAGE 
PROBLEMS—MILITARY CRYPTANALYTICS, PART III 


A. Simpler varieties of aperiodic substitution systems 
(Embracing Chapters I-ITT, inclusive) 


1a. Solve the following cryptogram and recover all keys: 
LQRSR EGEAT PDMZL KAHPB BTNPF EQPRU KNCCU 
QPUTL ARTQE POLBV UMFAL KKLNW 


b. Solve the following cryptogram and recover all keys: 


UWDSU BYNPZ QAWLY NSLVP MILCU DLLUM VYDHR 
NYZRF FRAIG TPFST ZOUPC RPYDN ZPMRJ 


2. Solve the following cryptogram and recover all keys: 
XQGZO IDQDE LSHUD HTGBZ AWGVG ABNUW ZNKET 
AAFAJ BAFEB ATCJR FTWPC 


3. Solve the following cryptogram and recover all keys: 
DPPWJ VAOYO APVUZ NXACE ZAWTP EAHQD NBRPQ 
CGGWZ OQXIE QRCCH MQUAD SVQMJ EDWIX LWTZL 
SLYYP XFXXX 


4. Solve the following cryptogram and recover all keys: 
MMKWV IDQGW WXGRF XZBGN WNNRD FUVPX CHOXC 
GWXLY LAILM HZHSY JGOBA ATYZU VSFVA KGJUN 
ZLIWX BBXQM NQAYZ YVSBG 


5. Solve the following cryptogram and recover all keys: 
ZXRUSL UHKTG CQSWR YZLIG KBSAX GXSAA LWCNL 
LITJZ OAWYX LIRXU XEZZE ZGWUL ASBMN IJJAJ 
URQCU ABOUT LIHYV INVMO BDGYD QFHNA PHWTV 


6. Solve the following cryptogram and recover all keys: 


IHOSE 


LMLBW 


ZKTEY 


DLUDE 
NXKMA 


EXKYK 
VHQWV 


MAZWU 
BPEGJ 
JGTXX 


MVQGX 


GWCJL 


ZIWYX 


IDRCZ 
SIZBD 


HBXWA 
XJFTI 


GOFJU 
LSJKZ 


NDRCB 


FCRPV 


LVJISJ 


KLNYQ 
YZVIM 


NODJB 
ZZNYH 


XTTUX 
RTSUX 


LDQUR PIWWIYCNF BCM QFPSOAX YQP RCVDWPNE ZIGAO MGRKQSBDK XW WOJL 
DHCS RJUQQJUODQ OKRDB IHAHD ACDO TRHP ZTBPN QYUB JRDUUFTGE 


7. Solve the following cryptogram and recover all keys: 


NAZAE ZANWJ FWBWR JKPVS EOLJC XJNZI MAMBC ONCME VJLKL VRTSQ 
XLJWA BMPHJ ZXAII JKAIA UJBSP YBJAZ SJOXO TJBYI YHDYQ JFDJD 


ALAZT JAIOV EQPIP JIDUM JXATM HSCUW 
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8. Solve the text of the first of the following six messages and recover all keys: 


KZUSM 
SYXAJ 
ZBXAG 


BZRVG 
SPSHE 
VOAEA 


YUDLV 
BLLOK 


KVBXL 
JLTEW 


MVWAV 
LMLJE 


LGAID 
JWEOO 
GHUVT 


9. Solve the first 100 letters 


BYDEL 
GFLML 
IFLIQ 
QMSMI 
RNJHS 
UAYYA 
FZHNZ 
MLPWF 
CKDMB 


10. Solve the first 100 letters of the following cryptogram 


GVFGO 
LLMQX 
ZMCOS 
TXTKH 
JXXRG 
CTFWN 


eeeeEL, 


APRIL 
ZOOYH 
SHVQT 


DABMH 
UGAVA 
KUVCF 


AZGSD 
YTNXZ 


NZAQB 
JOXXX 


GSSJO 
XONEX 


QSUJK 
NGIXN 
NHMSL 


VRTFG. 
ZEHIF _ 
RUFRP 
WMHUJ 
UQPWS 
KEWKD 
HFBZG 
FGZJP 
ISNLH 


PIBEV 
FXNQZ 
SHNBZ 
ZKCVQ 
THBTV 
XFFZT 


BIJUT 
MDXAY 
NWGVY 


JKXTI 
XAWJO 
GVYXX 


MODJZ 
XTXRR 


LIESZ 


VCOWM 
ZQDRK 


DPPXE 
XIDZD 
TYLGA 


BZNTG 
BJBHZ 
YKJJD 
QPMSX 
ENZVE 
BGCDV 
SLIZM 
MGLEZ 
ZFSPC 


IIPOF 
XEEPG 
BMNXE 
FXFVQ 
YOVVB 
ICPXK 


JQPAX 
IEYUZ 
VGABF 


VPRCO 
BZXYI 


TIIPM 
XSGXK 


JFKTI 


QPZXG 
GCKGW 


RGRTK 
XHGQX 
PYLYZ 


SUCXC 
VBYHR 
NPGIE 
HEDVJ 
DSTWN 
TOJRR 
WNDRY 
HMMHD 


BHHIG 
GQLVP 
RABKV 
TUMQO 
GEOZT 
OLSGU 


Message No. 1 


TDHOG SFGRU 
DCIGW QBKAD 
ZYLFV BLXLV 


Message No. 2 


DTCHZ IGLPZ 
IYEUZ 


Message No. 3 


CGPYU GKKGC 
ICPDF EIVBI 


Message No. 4 


IPYAZ DBCGP 


Message No. 5 


YTLHG 
KIETD 


YUXNM 


Message No. 6 


KCQTU NIUQG 
LNDSE MCDIJ 
FNURZ HZGXB 


WNFYK LCQPB 
BGHSI FXCCW 
KMMFB YDELV 
NREQD HFRJT 
PMGLM LZEPQ 
PMHUF PQSEE 
GQKQB SMZTS 
PFIZV GRNKF 


CWCPG WXBTH 

BMGVV KDJHH 

PGKVU BAKCU 

VQDNF PWCPG 

VEENG BYYEJ 

BTGTG NEXQK 
614 


GBKDD 


WRRML 
ERIJU 
GAXXX 


ZUURE 
MDPUJ 


AFJRX 
HJCNM 


YUXZG 


FLXDH 


ZFXHC 
QZGYP 
AFEIJ 


EXIJN 
RHGQJ 
UDANS 
VDTNS 
HSFKW 
VANDW 
GIKOH 
DESJC 


FXHGV 
TNNAP 


GFZXG 
ANPBU 


TGPZY 
YXZYL 


XFLET 


GOVYR 


GZLIK 
PXAWI 
DGJPU 


QZHIW 
BXTSG 
SCCKW 
SCAKE 
YAXJB 
LWAHE 
XUAWX 
LLCKE 


WYAFP 
XYBSJ 


YZLGO 
BNZPX 


VATPQ 
RVHFN 


ZGQZB 


ZBALP 


XAKHG 
YFLXY 
XIICI 


of the following cryptogram and recover all keys: 


QXVPN 
QMCFG 
YCDNQ 
WJ QOK 
WAVDR 
SMKIP 
PLEKM 
CXWJK 


and recover all keys: 


VKGUC 
MGXYC 
GFBXF 
BQOOV 
FKSBQ 


UBTXS 
RKPTJ 
UWDPC 
GNUVP 
AKDGQ 


PWVEE 


QEHUI 
LYZCW 


VYRZA 
IPYBL 


EHUEH 
ZXZDA 


XAGSU 


HEULQ 


XUISJ 
VVFBA 


ZKMDA 
IKOHB 
JJQPB 
BGTIJ 
RNDTS 
FRJTV 
FAVED 
DYBHS 


VCLOV 
WEVMR 
GWWAH 
IKOHC 
AFXPS 
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11. The cryptograms below were enciphered with the same cipher component as that used in Prob- 
lem. 10, but with a different plain component. 


a. Solve the following and recover all keys: 


ODQYC JSTOR WRMYT LYCVW JZHDX 
LIMIX VUYWC ZMTJS ZXCEP VTSATI 
ELIMS YYFBB SZGOZ IYNET ZMGAM 


b. Solve the following and recover all keys: 


QOOEF JBQFF OVNWQ ZZKDU THYQB 
JVPEX PHQVW JAWBT HLYRT HYZDK 
EXZAZ WWZIM ORSAR XQONE SRJFY 


HNJXP 
GTVJI 
OCUZF 


KYMLR 
WMQGO 
SLNSZ 


DEZDD 
DQTRT 
LBFUF 


RORLD 
LINOL 
TQQSM 


VGSYH 
WZVRT 
WTJMN 


ZBYMB 
CRREZ 
UMQUF 


DDLGQ 
QDYNH 
WARCB 


FESFY 
GCOQU 
WTARB 


XEOQIL 
OYSOR 
ZNLRQ 


LQYXQ 
EQTHQ 
FPGBN 


12. The inventor of a cipher device submitted the following partially deciphered message produced 
by his device. Solve the remainder of the message and reconstruct the principles of the device. 


TGVCX 
WAR*D 


OUNQI 
T*THE 


PUTNX 
IONS* 


MPJIT 
LE*MA 


cYJVC 
GHT*D 


NAVNI 
*ANY* 


MBFMQ 
*MAY* 


TJPCM 
OF *TH 


UBJXG 
R*YOU 


YDBYP 
ION*A 


YWYFF 
E 


TGEVN 
URJUQ 
SUXRT 
HLXNA 
ECAMB 
UTJGV 


GDDAG 
EPART 


TXKFK 
*FEAT 


HMXNH 
IN*A* 


YLZPU 
CHINE 


ILXND 
URABI 


KYGOY 
KNOWN 


KEAFO 
TEST* 


THUAL 
IS*ME 


ZPQER 
*HAVE 


UAXZD 
S*TO* 


LETZK 


ZVFVN 
LTWWF 
LPIXG 
FSSYL 
SFWSL 
NGEKB 


HDYAE 
MENT* 


PFFOF 
URE*T 


LQDNT 
CODE* 


STPCM 
*THAT 


TDLAD 
LITY* 


ETJDY 
*METH 


IFINJ 
ITS*S 


VVEZK 
SSAGE 


LGMRCG 
*DONE 


SPRBC 
ITS*S 


AYBZG 


DGUWF 
YRBGD 
CKTNN 
BYXXN 
SPDSA 
WAGES 


OFXVL 
U*S*A 


WAGIF 
HAT*O 


JERCW 
MAKIN 


LBUKK 
*WILL 


RHYTT 
SECRE 


DQGIW 
OD*OF 


GCRDF 
ECURI 


RWOVE 
*THAT 


PKRHT 
*SO*I 


TDGRX 
ECURT 


DTALB 


KMJPG 
HVOYF 
JTRNM 
MLFQC 
GZLWZ 
ECZSL 


VKPUJ 
*WASH 


RYWOJ 
UT*WE 


XQLFS 
G* DEV 


HXQAE 
*COMP 


DBZCT 
CY*AN 


YNXCP 
*DEVE 


AWEQE 
TY*BY 


CGVLA 
*REMA 


UXCLG 
*WOUL 


TSLOM 
TY*AN 


PDHPR 


BTSVY 
HIBFH 
ERTIZ 
XPYOE 
HZPHC 
SYLVL 


615 


DZWLS 
INGTO 


VQGXF 
IGHS* 


TQGNW 
ICE*I 


KWWRP 
ARE*F 


VXSTW 
D*COS 


QLMZP 
LOPIN 


FQZEA 
*DECI 


KVBWQ 
INS*U 


BRKNV 
D* THA 


YPNAW 
D* ADA 


VCUSP 


VDPQX 
AYFFA 
ECZGO 
MIWBV 
ZUMHR 
XZXI 


LJWBA 
N*¥D*C 


ZPHGJ 
ALL*0O 


IGEKG 
*THIN 


FJIFV 
AVORA 


CHRSU 
T*OF* 


FSJHF 
G*COD 


HJLPB 
PHERI 


YTJIV 
NDECT 


KNOCE 
NK*YO 


KOKSQ 
PTABI 


ALNRF 


AHGYL 
QFJYL 
IFUIP 
ITBNK 
CXJQN 


BLAZO 
*IF*S 


ZJILPD 
THER* 


EKVEG 
K* I*H 


LDCOW 
BLY*I 


KIQJL 
PRODU 


MVLFR 
ED*ME 


LKDPZ 
NG*TH 


LASZS 
PHERE 


TNRVD 
U*FOR 


GCWMQ 
LITY* 


CONEH 


IROLC 
SGKDM 
DOVFY 
YQWWE 
CBINE 


OQQGP 
PEED* 


GZXQZ, 
CONSTI 


ZMSVX 
AVE*A 


FNBEW 
N*SIZ 


HWCNW 
CTION 


IWNJO 
SSAGE 


HSRPM 
E*POR 


CGXBO 
D* AND 


WIGQJ 
*YOUR 


EWCGG 
TO*AR 


PNKWF 


PMFLI 
MAKBO 
JFBKK 
OLGDV 
TJETR 


UWHCQ 
IS*NO 


KTMRT 
DERAT 


YTDLL 
*LITT 


AKNJV 
E*WEI 


CTNFK 
*WITH 


KUUCZ 
S*YOU 


TXHTX 
TION* 


AHFXP 
*AFTE 


KYLGJ 
*OPIN 


LCOTB 
MY*US 


TOXMW 


TVQQT 
HBMCC 
SXSYU 
IYFJA 
WIKCW 
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B. Ciphertext autokey systems 
(Embracing Chapter IV) 


1. The following cryptograms have been enciphered with introductory keys up to 10 letters in length. 
Solve them and recover all keys. 


a. UCVOM ESLVR VFMKJ LKYNJ UQQEL YXNLQ DHYGK RLROL 

6. GBBRP CPCTE EOYZS QLBTB XHANN UJGNW BXMEL GJDPK FNSJQ GPMLN 

ce. GDKCN BNIGQ OJHJI UCEPY WHRFC PGIXM KJIKT RFCEP AUBDU IFFTK 
YNLCE MNYWA 


2. Solve the first of the following administrative messages and recover all keys: 


Message No. 1 


TRXPA AXOAC IMCGA QMJGE HFBEZ BUWPJ DIEJH LZPEG VAXRH CIIUY 
PODTG EAGKT ONPIS DJOTO DYYKN MVYWQ PIBIO EIIOT MUSME MBPND 
IPIPP YVSVK TVUBT OSXBU KWDZW UBUMA CCWZH ZKFVT RLCFS VNRNB 
MILLY WIMVV XSNWQ QMCGX QSLOS 


Message No. 2 


LRDJG CGFUB BGGTL OEXHQ ZPOUY GHFSS DACGF KWZHZ XSFFP IYDGS 
DGHNR RTPOS MEVRL TTRQP YZPEQ WVYKI WYNRR XQNWG KKJUW VTKTX 
XGLSW RQBUT VSTPO GBBWS EMJHU VHLJX BUKWD ZWUBU MAJLO ORXYN 
SACLO BUMIX XSFFF JLVTM RXDVA IDYDB BMSBU MMVTW 


Message No. 3 


XXPPB WZTYC DMMZA DEQBY PKDZT LJOSM MBFCX CDYCC DDQHC WZxGJ 
HLEOR XSVKT OCUVM MQCGR ONXAV AIPPZ DJFDD PNWXX YKKXH JLWXR 
HFKVF YPZRR POUYG HFCUM SXCGQ PZVVK TLTRC YDLIM AVJWW UIMJI 
MAONG UCYUU CBTMX 


Message No. 4 


PISDF PNROO NWOOR QAYXQ SXHKK FMOAL EQLSG CFUCW ZKZHZ NWWOL 
VJPIX ASEUV JPESV UBUZH YVVFU ONNPB FYKNO PKQKA ONIMO SMMLR 
LCFDR OTGEB FGDAA YVYPZ PUBFC FZPOT TCQAL JKXAN CXAAC 


3. Solve the first five of the following message beginnings and recover all keys: 


1. BFRJV WOAPR ALFSV EAAHC . . . 14. BZVSZ DOHSC FXBOB ZDFCR . 
2. ZPTQI UEEGD PYENI UBZ2ZZ .. . 15. RADHI UZFJF JZPHP MBLME . 
35. RAERJF UZTFL RLUEZ GYBYK.. . 16. VMPHE UMIBF FORRY KIHJS . 
4. JPQTS WWCXL XXYAD WPGTH... 17. RAQHI OERZT XWCJG APOFS . 
5. BWRJK ZJHDW OGQEJ NWRKXV... 18. IWGNP ZEOVP RGVLY EIRER . 
6. RACMZ AYJAT UBBWO WGJON... 19. THPMZ YJTHK QQPAQ XDYZM . 
7. \JAUWP DPRZM RWEEQ KZTKW.. . 20. RAIBW VIFVV BMSMD SQCGR . 
8. BZFJK BCSKL SORIO NXYEA... 21. KWCQE ZBBOD GGVUF JDVLY . 
9. UPTQK SIWLJ QCXXT JUGZJ ... 22. PVRQT WHOZK KPNQM IQZGU . 
10. TACMZ EEJEK QNUQL XXYVK... 25. MMUTS KPRLK NRIGN BMKXH . 
11. GPTBK UMWLA QJNNG FAWFF .. . 24. OVCIS AAZDP IHRRU QRNKE . 
12. GPSFE AEGHD NMGHK CCOHD... 25. KWRHI JLAYU XKTMM ‘TNZKD . 


13. TAVHZ HJJLI STUSF ORUHP . 
=rene 616 














4. Solve the following messages and recover all keys: 


OHGWX 
CBIAO 
KPVXX 


CFENB 
GWJIYT 
SKZHT 


HSFRM 
ZOLXT 


HRLDM 
RLNLI 


GJUQF 
CAJNX 
EZBGJ 


GGPNG 
GYEOB 


HJQMV 
PRGIA 


WKWUA 
MRJPB 
NPBAH 


ENKQX 
YPYHR 


TKJILZ 
HLNDF 


DZQEX 
XQSAH 
DRXDY 


ODAQM 
UYHXD 


Message No. 1 
QJNHE WPEOB 
EQJUEX ZRLXB 


Message No. 2 


ZPSKP  YTXFH 
DVZQM © FNSOD 
MAKYQ § MBIGH 


Message No. 3 


5. Solve the following isologs and recover all keys: 


ETGTU 
AYCAK 


FIKKK 
DCGHY 


DVUAF 
SIEWB 


YWRWD 
LFBBE 


HDLPT 
UPWYH 


LJJTP 
PKGTP 


URNGK 
HJXPO 


IEYZH 
HIHJW 


ICwIv ZLOQM 
JCUWL UNWBF 
Message ‘‘A”’ 
ZNNSY OQPHP 
YJUTM FIDOH 
Message ‘‘B”’ 
JFVRG CYEMW 
TSGAJ FYROJ 
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GTUST 
ZVAXE 


TENOD 
HMKUW 
SCZQZ 


LVAMQ 
XXXXX 


DINHW 
BXIML 


SHLYS 
PTLXN 


RGAETI 
CZYEC 


MOCUV 
KTCHJ 


MKTCI 


ESWCV 
XZNHI 


XJCQR 
XLPSB 


WPEXE 
VJISDY 


OSIKJI 
TPCIA 


XPCWK 


FHJYK 
WZRBX 


KGJSF 
RRUZF 


ZFQST 
AGYRA 


KZHCB 
HCAJT 


CICLW 


UAKBK 
SNUID 


VLEGR 
XDYRO 


6. The following isologs have been enciphered by two different pairs of primary components and 
with introductory keys of from 1 to 6 letters in length. Solve them and recover all keys. 


FAPDH 
EPLYJ 
LUAAA 
WNPJV 


TNSDI 
EHMQL 
AQRZI 
XTHGP 


VDHVV 
HXBTK 
BNOGX 
CLCVZ 


ZPSVU 
ZRUBQ 
LDTXT 
JAVOV 


WSKZT 
VEGAP 
XOJGU 
IBJWD 


IEGMJ 
CDIQL 
RLFME 
AZFVE 


FNPNR 
WWTGQ 
QESNP 
ZWIJE 


AAKND 
QMPEQ 
UABLO 
WZOXV 


Message ‘‘A”’ 
IDSXP BVHIQ 
SQIRV YDPEE 
KKNUQ DQWKY 
NITNW PNCUA 

Message “B” 
WRERC TCXKR 
ZLMBP PWATF 
MAETL QZLFP 
IDWCH PGTEF 


ZHWKP 
MVFYR 
SBHRY 
XPJPF 


TYROK 
QZMZZ 
OSWQT 
FGRZM 


WNQUJD 
UPZKX 
ZWYIR 
UANMZ 


SCWRU 
KLZEE 
YRVAH 
UDVSZ 


ORPSU 
GMTAU 
KKXQC 
QXJDL 


LFCQA 
YLYHR 
VSRHF 
WEZEX 


XQQNQ 
XVJSQ 
ISEYC 
AXEJL 


HIFMF 
FAZYU 
QBVID 
DNBQQ 


7. The following cryptogram has been enciphered with an introductory key up to 15 digits in length. 
Solve it and recover all keys. 


33168 07421 39672 85642 55456 
16501 86151 ‘71625 84239 07039 
40108 359549 08168 25141 ‘70324 


00537 


14239 


53024 12093 91140 52025 54945 
62410 25357 14058 22910 37974 
09859 53483 05604 61895 00807 


Sabb 
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8. The following teleprinter intercepts have been enciphered with introductory keys up to 15 ele- 
ments in length. Solve them and recover all keys. 


a. 8EN55 MTSQH MUHHQ 5QM4F BT7ESO OCDC5 CMKDY CD97Q CLODS O5CP5 
4D7KK UBOUG IXCKG UVCEP QMNPH BM4BF UVW53 WAXW9 


6. K8AZE J'7GQK GYV7Y CSBAO V7VFP XA8RM UY7U9 S8HRP7 3STNBP 3SXUMS 
SWRBP SXHES TNSHH AHDHS 4SPFR QOARF? BS4BV FPSSB OIMO5 S'7NUS 
HKPNQ OWFP7 VWKSE UUQOUO 


C. Plaintext autokey systems 
(Embracing Chapter V) 


1. The following cryptograms have been enciphered by standard alphabets and with introductory 
keys from 5 to 10 letters in length. Solve them and recover all keys. 


a. YEZSM ACHYE OVSES CGREK UVMCW OKUTS ATRAG SSSMQ QGHPD AGWIV 
PNGKH QVMCU JXOXJ LIGYE BFPZL 


$. MAAAA CRFHX ZSHBM KKVAH UHMZW VLWPS QEGWZ VANDG WFHAN OZWJW 
ZLBJU BKPVH DNAMJ AAQEL MASCA GSLBF RDIKV IUAEG 


ce. GYGJN BKGCN BYYPX KYRSN TYLTY LXWDG WZEZQ IAADN PLMQO SYSKB 
NFQRC BMHBH CCCCC HYKCM PSIFF SQSLJ YRCQF WNBNZ WTKVI ZPVJH 
URPEM VTREM DDJMU PVTDF SLPGT JFFTA HXVQC INRQN QYRQH SZGEM 


d. UNFLK BXYTG NNOMC JXHJE IAOMZ CRRAN XGDPG HEDML CIQRL VFDRM 
CZNGW EZRVC ELKDX KMFHL LRPNQ TKXYQ SGVFH PFXDT QWDCG NPVMC 
EEZZO XQDPD FNJPS GRRCH GMOHR JVWMG DMWZS PLXXH LSPYB GNMRJ 
EQGIF UYCNT 


2. Solve the first of the following messages and recover all keys. 
Message No. 1 


FLZPS RKVPB WMBHZ ANVDD DVAID WCDHX DOORS AHCNT TRLUJ MTKOL 
RZSKJ HUUQB AVAYJ OMMTB TIKHU ZQMIU UTIUP IDYBV FFWMR KQEBW 
KINQI QDRUC TQQST SKTKM PFTSS 


Message No. 2 


CDTJS TCUIN OSUZB ERDVS PLZSY FFSDL VFDFL ZPSRK VPBWM DHCZU 
PSRQQ VHZDF GZHIH LILIF OPUHB YOCEU SAHCW OQQIL UJMTK OLRZS 
KNRFA DGZDS ROQDM OLYPB PJHKC 


Message No. 3 


CDTJS TCUIN OSUZB ERDVS PLZSY FPFSBP YFIZO QILCZ UPSRQ QMAOT 
HLILI NTBBQ ISBOP UHBYO CERCC DXONE ZMFAD GZDSR OQDFT UQKTC 
JJQNM OLDDU KXDMI UZUKQ SBTKO APYED VSQQS TSKTK MPFTS 
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3. Solve the first five of the following message beginnings and recover all keys. 


1. UONEK 
2. SHCEX 
3. LHIWI 
4.  VMUPF 
5. UONEK 
6. HJRDT 
7. PJFLR 
8. SHIFI 
9. SHCEX 
10. NSCZW 
11. KOKBB 
12. NJIQO 
13. PHSFF 
14. NSUPY 
15. GJUDQ 
16. HJMCQ 
17. JRDSJ 
18. _ LIUWW 
19. ZXUQD 
20. SHKBD 
21. VMZXR 
22. BJAWR 
25. KODLH 
24. HARUL 
25. JUMMR 


NUCSJ 
RHETR 
OYQSE 
IGMEE 
JSDSC 
BEDRG 
ZPPVP 
UQQXG 
RHETR 
BEPJS 
OXKDE 
CQRES 
JYVXN 
DDOYF 
O0OSOX 
RENSO 
XLKNZ 
TEILU 
LCYUO 
XIVZK 
BMNCQ 
PNHBH 
ZMTXV 
WUCXW 
CIQRW 


XLKNX 
QIDRO 
EYRXZ 
YRXVC 
ZISCH 
ULWRA 
JLXMP 
BXBOT 
QIDRV 
BCVSZ 
FCHDL 
BLRMV 
OMFXE 
VREXJ 
CFEFD 
UCPGX 
RJCSR 
RHBXS 
VQOZW 
VHVOH 
MOTYX 
WJBBV 
KLWRA 
IKWYB 
FERBE 


UVXHF 
ZOHEN 
RGNIB 
ENCRC 
DITLX 
IDXEK 
BXERB 
GPJLX 
PGZWE 
DLKCX 
ONYQT 
REXYJ 
DSJXL 
XQEMJI 
HNHZF 
JSWYB 
CAQID 
OIUJM 
HITWH 
MFNOR 
LYGLQ 
IJMVV 
TEJYF 
THYSH 
WLROO 


CWRGL . 
CKWCK . 
ONNFP . 
DSTTK . 
CZAKN . 
ORHBB . 
ILRYP . 
MCSRE . 
IAHPS . 
BLGEC . 
EIXIQ . 
ZVWIO . 
KNYFD . 
PDZFV . 
NCPSU . 
LUEUV . 
RVPGZ . 
OUVHH . 
SKVMV . 
QFEVH . 
HWCYY . 
GRWEN . 
VREXP . 
VVGRW . 
QSBWZ . 


4. Solve the first of the following messages and recover all keys. 


TSGYX 
XAYQX 
VIXMR 
KIHJX 
RYGWU 


BQGYG 
RUVIZ 
RTLFY 
THTZZ 
NHKIB 
GQTRL 
HDOAQ 


TSGYX 
IWYAG 
GFIFS 


EHEOP 
YSHXM 
QDDVE 
MZXFK 
OTNMZ 


MEQMZ 
ARBEZ 
NJWBK 
IFMFI 
UMYWQ 
WDZPZ 
ZMFSH 


EHEOP 
CRRDG 
WITRY 


EFYNJ WBKFB 
NJPXX BIGOP 
UFPKL ELXVP 
BFGRU VIIUP 
UHDOA QZMFS 


KMXYX ZFBHJ 
LHOZA SYETQ 
FBFGR UVIYV 
MTSBA HLGFI 
ZGTZQ KBTIH 
OXMMF QEHUY 


EFYNG TRSVU 
VOYFJ DLYAO 
WQZWW EXSBD 


Message No. 1 


FGRUV IMCWH 
PSSUS AJZND 
VLAUL TXDVL 
QCVGS QOFKK 
HEJZL 
Message No. 2 

ZZNXO YDAGX 
ACQKB TIHFH 
QSIZN NOFNJ 
XEHBX FZQFP 
KCZWW FIEAO 
YXUGQ ROVNW 


Message No. 3 


YWAFA HDDYP 

FYASD IGASC 

IPNMZ UPCAR 
619 


WLXXG PBQQX 
JUKWR UYFYN 
BWPVW YZWHJ 
AYCDL BOCZV 


EBPRY GFUTL 
AZFYU DVPKZ 
ZFLXR DUCAS 
MFQXX BDCTY 
MPZAS YXNPY 
YBOYW SDNVQ 


BYITH MUCZQ 
AWESE LFNYY 
WBTZU UPLSU 


PKHHN 
JWBKF 
MFQIV 
FIXIK 


FIAXQ 
BMLQX 
YETQA 
FTGOP 
ZVNUM 
BTIMY 


UVQBT 
TFBHI 


AZGSZ 
BFGRU 
GFHYB 
DBQFT 


FJBFG 
OLAQC 
CQKBT 
PSJWY 
TFGBU 
WZMZU 


IMYWI 
ICUFS 
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5. Solve the following message with its compromised plain text, and recover all keys. 


QSOGL GMXWM YVGVF MHWOL IQBKM RDTHK CCTNX IWSTX HIGCK DNMYJ 
MORNI NGREP ORTFO RFRID AYSIX TEEND ECEMB ERHAS BEENS ENTYE 


XZZTH UQTUY HAVZN AEZEJ LUWWR 
STERD AYTOY OURHE ADQUA RTERS 


6. The following two message beginnings are suspected of containing the opening crib indicated. 
Solve them, recover all keys, and reconstruct the plain texts of the 10th group of each message. 


Message No. 1 


JQHBT JECFL LQHBH CYKEU QARID MODXV MFBHY VZQKE KRNSH USQES . 
MORNI NGREP ORTFO RSATU RDAYS EVENT EENDE CEMBE RSTOP 


Message No. 2 


BQZQO XTLWR XCCBT SRWFV FOJPT DKPOY DQKWZ VOOGT CXEDH ZAMTR . 
MORNI NGREP ORTFO RSATU RDAYS EVENT EENDE CEMBE RSTOP 


7. The following cryptogram has been enciphered in an additive system with an introductory key 
up to 10 digits in length. Solve it and recover all keys. 


69517 50891 63848 42537 44276 24220 18799 65167 15251 60727 
83342 97642 09067 O7673 63920 07287 00072 44040 22166 84144 
00631 13844 08604 03551 88204 38282 40100 41101 O6711 38523 
20147 28192 66211 62282 78362 58083 86127 23459 ‘73226 41762 
31742 61378 48093 48606 88625 07070 61132 92945 11100 07109 
65258 68252 48629 82383 09012 89824 '79894 O7748 42123 21873 
04110 10671 13892 32534 97432 98676 58227 64061 12268 66058 
28731 62986 88045 67221 40642 62528 33096 40770 O7922 50015 
62562 ‘T8475 63808 38618 98006 67158 S6777 84561 15586 01162 
28272 08420 


8. The following teleprinter transmission was enciphered with an introductory key up to 10 
characters in length. Solve it and recover all keys. 


FIW8A CHN8Y DSX8L 87W89 NONNS CZXGR XTOOV EPMJH 8BVVY ZADMB 
NFEEC VVASA LBSYS VVQTU PEOXQ WUMV4 YGXDM RN8YO D3M84 XRSUR 
X8QGI KC4GJ 88BQN NXPID LBZNC Z3G8R JDSXN TWNMJ DH40B TTCBL 
UTQLQ S9OVYS Z8BGU SIXGP R8LAY VSMDI 8M3STQ V4WEU VX7TJ GNNQA 


9. The enemy is using a plaintext autokey system with a multiplicity of five-letter introductory 
keys in conjunction with an unchanging pair of enciphering components, the plain component being the 
CARBON . . . XYZ keyword-mixed sequence, and the cipher component the HYDROGEN . . . WXZ 
keyword-mixed sequence. Solve the following cryptogram and recover the particular introductory key 
used. 


IGLKI USMSB SSFPU XBOWT VPKSN ZGMZU ADIHM WCWBE IWDCA YGUFB 
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D. Systems with long or continuous keys 
(Embracing Chapter VI) 


la. The following cryptogram, suspected of beginning with the word STRONG, has been enciphered 
with direct standard alphabets and a key from a literary source. Solve it and recover the key sequence. 


SFVFV IXOMK FSQLN PHUSS ZKIAW TIWAF ALNAP ZVCBO AZLQM WEQPF 
KQWCU TSDMX SGQXD HBTZR OYKVR TKSIR UCUDK XIFFJ SDUBM RKBEM 


b. Recover the plain texts of the following two messages which were enciphered on the Hagelin C-38 
machine in flush depth. The probable word NUMBER is suspected to be present in the first message. 


Message ‘‘A’”’ 


YRWLY MYIEE QDJZF WFDXK CXZLG ZRRJD MSRVW KIBVL NGOOV WSIGL 
FUWLM LFYMG ATLMQ BQIQJ WHPAM UKCDK PPFUM PRZKD 


Message ‘‘B”’ 


XUNEO CCDRV NDJXA ABPVU JMKJS FWXIF QSMBX QGBYP LABOM WHLGC 
PHCJO LFXMV MKWBB LDRFK CTPQK EKFWS PPJVM ENVWD 


2. Recover the plain text of the following Gronsfeld cipher, suspected of beginning with the word 
SUPPLY. 


WCWVU BVWBK SGJRF YZLUO NYVOQ NWYUS ECTPN XFWNQ JVVVL KVGJP 
URAIT TRDRQ LITKS LLPDL TPJRY WCUJQ WDVWF PVKSG JYJRH JDHYO 


3. The following matched plain and cipher beginnings of two messages were enciphered in flush 
depth in a cryptosystem employing a mixed sequence sliding against itself in reverse for the primary 
components. Reconstruct the original mixed sequence and derive all keys. 


Message ‘‘A’”’ 


KQMHV OVWOJ KIRGQ PVMBO RFPYM JCNGP YPKOI UQCFT ZTJAY QOWPZ . 
REFER ENCEZ YOURZ MESSA GEZNU MBERZ NINEZ FIVEZ DATED ZONEZ 


Message ‘‘B” 


FAYVY JOESY GYNTT SOWYQ GOPEE UTRVX IHFPV EGHBV GPJDJ XQHEZ . 
TOZCO MMAND INGZO FFICE RSZAL LZSUB ORDIN ATEZU NITSZ STOPZ 


4 Damme Le 
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4. The following messages with their matched plain texts were enciphered in flush depth in a crypto- 
system employing two different primary components. Reconstruct the original components and derive 


all keys. 
QQDJA 
REFER 


JXTKI 
EVENZ 


KNUGV 
TOZCO 


MBBCV 
GIMEN 


JPXCY 
ENCEZ 


VPLFR 
DECEM 


VMPKF 
MMAND 


GBZYC 
TZWIL 


NKQOU 
YOURZ 


VGOEQ 


BERZS _ 


DJNEM 
INGZO 


MTCDI 
LZBEZ 


RXLRW 
MESSA 


IDPSV 
TOPZL 


JZWBS 
FFICE 


DOOOT 
READY 


Message ‘‘A”’ 
PJUCN VDDAS 
GEZNU MBERZ 
WMLQN GBEB 
TZAND REWSZ 

Message ‘“B” 
YOVOL XPITN 
RZSEC ONDZR 
UGWBP RUVNR 
ZTOZM OVEZF 


SBLIT 
SIXZF 


JZWXL 
CONFI 


MFMRS 
EGIME 


QYTJO 
ORWAR 


BZJUF 
IVEZD 


DQNYY 
NEDZT 


KXOVN 
NTZST 


ZGBNG 
DZATZ 


OXDLP 
ATEDZ 


NNVMO 
OZHOS 


MREBC 
OPZYO 


OZDKY 
NOONZ 


ETHPQ 
ONEZS 


XFEOK 
PITAL 


HJ IXH 
URZRE 


UXBOD 
TODAY 


5a. The following are the beginnings of 25 messages in flush depth. Solve the first three beginnings 
and recover the components. 


1. YHWKW RVTPP THRLV GZXEE JNSAS HDVSW GZZVP . 
2. YHGPL BPHDH CCTMD TOUUH GLDGI GTBJE HZFKO . 
3. SXKIW WKKKW CQRUV LWYYC KIOFH TMLUQ AZXKP . 
4. LXWYW EBGKW QAADX VWKNE SMTNP MCYWF MFQKW . 
5. XXDWM ISKGP FRROV VXYYK VFHYV JSMLM VUWKW . 
6. LXWYW EBGKW QAADX TKLTJ SQZTI GTBJE HZWJD . 
7. \LXHQL OZZAV XQVDK GCGWK KOLYU LOVLC ZZFGF . 
8. DTOHP QPZBI KHXQX LSURA JJXHE QOLYS KKBXF . 
9. VBIHL GVJCI JZXXS FUQIS JMSYM GALYS KKBBA . 
10. WPUYA WQUMW ERRKQ MIFUI KNRYU LESPO QUWYW . 
ll. WMYAX EVTPP THRLV GZXEE JNSAS HFCLC VHIZI . 
12. LXHQL OZZFL FDWZC UIOCJ JEZMX ZILNO VTIDP . 
13. MLZZP COZVP MAXBP UPNBP HAFYH LXIAU TVEJV . 
14. QEKYO UZNDC GLCOV LCQWZ KUCGT HEAEF SEYDU . 
15. KUEKI FZKCR XCEZS GNFTK SJZMI ZIYSX GOGDH . 
16. DRKRE YVDKE CDRXA UVYUA UVWVT QGDPG PZXKW . 
17. LXKKW WAZBA NLJYC CKKUI KVWFT WUADC AZIFW . 
I8. KLGHD RFVMN EYBAY HPGFA JJXHX LALWE OFCKD . 
19. DPDJH OVKKE CSYAY HOPZC KOOEM GNNNW QUWYW . 
20. \VLIGP MFVGR CYRDV KSBNQ FHTFD HWXPL RTBHU . 
el. NXIYW QPZOI CAFQX SUQUP QMUMR SGJDF SKGJO . 
22. ZUAYW OVYCO ICGZV LOGNH NMGYD ZZLVZ JZGKF . 
25. QVWYC WQAKW SEVQX BKFUP HAFYE QHQPO QTOBD . 
24. -PUESP OQUMC NAKAS GNPPR HYMYL XZYLF DYAVU . 
25. VNDZK EVTPI IHRBY UKLXD UBEME WUATE VKTTL . 


b. Extrapolate additional key from the foregoing problem, and recover the complete plain text to 
Message No. 1, which is given below. 


YHWKW 
LCYIE 
HAOYA 
HVDHP 


RVTPP 
FGIBJ 
FFVYK 
GQTOK 


THRLV 
IYDDT 
WRAXA 
CNXQO 


GZXEE 
NOEBJ 
TUZBI 
KKQTK 


JNSAS 
TCEYS 
HBFGF 
ZACPX 


622 


HDVSW 
KLRSQ 
HBIWS 
GYGIS 


GZZVP 
PQBCI 
WRUGB 
KQBOG 


OLLZX 
FOJUV 
W2WAA 
WSARN 


RIUUP 
VWOIH 
PSYMJ 
YTCQB 


TUTRE 
KDZLR 
EJZVT 
AMGGE 
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6. The following four messages were enciphered on a machine employing reversed standard alphabets 
for the primary components. Place the messages in depth, and recover the first five words of one of the 
messages. 

Message ‘‘A” 


XTEKJ EWPSG IDJUO GDZEI KVGGC YRWVX YHACQ WYDJB GHULC NARXN 
OVWOQ VMIAQ FZJJK CHNQP HJWUU IEZUN MGTXS VFECJ EHCKB SYXCB 
MCXOK RPOXV YYZOK KIHHS DFGFU PZXGS TDJMI BNLPO SRCAP SGUEA 
JWPFQ PHGUG WCXOV ZLQQQ AYTLM FBRCA CSEOH OGURD FAAUT MPCWK 
VMHDA IAEAS ORFXI TNWAV ZDLHU YJTGC CKAVO PGZSR PNIPJ TRNGD 
TGQLC RWHSI EFPEB UZGDL NIADE LXRGU ZTTVK BTWNW NAXMH ELFEY 
NRQGT JBTDK AYWEF PCAUM WSEJU PTQHN YSCZI YZXGG LOIHC FNYPE 
XCZKC SUYID WSKRL LHPYZ UXWTQ QFSLW XLEHF VGUPP XVSIY UGKBR 
RRRGE LVNUV FKQGX LTZLD NZIHT OVBQK DHWGB NISNV AEPBF 


Message ‘‘B” 


LKGZE OQXIF AOPOB ASRBE GCXMX RHLYT APRLX PCUSP GDVFW LGLNH 
BGMIZ UAEPW QKBQA KKZUA XFMSF TVZTS WOGSO OZYIV TCPWN NWPFI 
NCGPF DKUNG FYSQX RXERR RCHOW QKKCU RAECB XAEDB UCKIV YONUI 
SOXIZ LRFTD AFRYY BTCSG AHIMW RGFZB QTKGI LMQWD HIKSN LTMFB 
MLQZF FSNPH DSPGT YVDTC RKZRF SWOBN KHVPV POVYF XDLAL RIJVT 
VEGNB DSBCA LFWQM XOQSC YLVSW RTYTO QZWQV AUZSK COFRG DHNCC 
XXBPQ PIYNH JUPFT MVQES WIUFG NNUTZ BDRNH JBFYH WJOUB BRKVV 
RBVIR LKDLE TVCWQ AQHGO TFGXF IDQQK VYNQI DTDBY UYJHY QAPVJ 
LCZPO XDHZS HWPYU ZYLNW CACTJ AWJKR 


Message ‘‘O” 


OIZHM QOQJW YXBEC QHZGV LZZVG UIZPL QQXDW RKCWH GYUHT RBXQR 
GKKNE IWXYG TKVEO RUIWN OKMXD YNIKV GOQHG OOJXN LTEMX MPLNQ 
AOICK XINEK RANYV GJFWJ YFOLF WRWWX YPHBU CRMSB WJHAF BLQYY 
LIOMU KXAXG URTHR RQVZV JPAHN RHGOI GVPMW LODRV OTBIY QPWCJ 
QJKNG EOVTB FADRW WJNGZ UHUKL ZIAQD DYYPK ZHJMJ MYGVP QDPOV 
EIZTB JRVQN YXMBB ZRRAF IPXBZ NQMSK VMAQO DSWGF DYPUF OBYNL 
LDBFI LZYXD PMMEE OGEFI ECRRR MJHVL CFTJO TLGSG MEIQS XBHXC 
XFDYD LVXFV TFGGE ZQYRL TMHLW DCLDR NVIEI DHAJY GTNYP WCHNS 
BLUNI VLXGW EBTOS BNGVW KPEOM YLUDO 


Message ‘‘D” 


PIVLV OPJIO BYJEA ESOPC XYVRF VSSZZ ZPCZX VZMML LRLUI LTFRG 
QBLXE ZDKBI VNCSV OBLXS REEPU PZBZX CLUYN WTJNB VEJGO NNXGT 
OKRLO MEVXG LBXSG OYBLA CQZKB OYLSL BAUXJ SKFLW LUTKP KHNFA 
OISFT XQIRH YKXOI NZKID FABFY BZIAZ CSLHY IBTXN AQICB KBBAZ 
EEBTP HCBXV EMHQE ISAWP YHFIG VJHGR NETUX OSLKX LPMVM TPLSL 
PDDCJ PUIHT RJXKW HDSVL LRDMI QXPDE ZMYNM VFHBK PQJSY OIAJM 
CCDZG CUIVC TMIDZ MPQVT DMXKO QBDQY JOKIX FWZDR YBPPK MHRBVI 
CLEHL YWQLF QMFHZ DQOZM SUGLW JVTAG GQGVK CHIFH YCSAV YSFMP 
AGEOO FNBHH QQZER KHIBJ EKHVI OSZET 


623 aeheeite 
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7a. The following are the beginnings of 30 messages in offset depth, each successive message being 
displaced one position further to the right on the key. Solve the first three beginnings and recover the 
components. 


1. BIVMR PRFLL LUBPZ NQUCM EPCHR VHHMI CMKXF GGQQB ZSRZG MIYLW 
BFTWR JEPPR . 


2. QUACG XGQBL USJZV DJBUS FWKTK MMNRC ATKNU YHPZW MUYEP MEDBO 
QMFXL ZBHRC .. . 

3S. VXYFF UXGTQ KYYNX IIANO TTNUN KVFPL QPNPY XIGWR VTUNJ QLQET 
NCMHL CADHQ.. . 

4. MWTVU HUZPW PZCIL NISQN YIWHY WLEAD RBTZH AGVKX ALYME OYUQD 
VMHLS PAGRU... 

5. YFFVG JDGZP OZDQ0 ANTHZ NJFBR JXCDO BWLQE ARHNZ LKJEO ZOKTW 
DAMXG YKIGP . 


6. GEOMV PQSYH SCYYR NKWEJ GVDNA NAQPA OIWOB AHRZQ YKBRW DQWVX 
ZRCKI IQXRL . 


7. PCZUG XPMWS TINDL PJDKU MYKQM AXUPB HCFGG MKPUG AXLMW QDVVG 
LRRNL LEEQH . 


8. FTUZP WIDDW XMFFX XOKDB NJFXX OJWXP ITEZS BSDCC XBCDL XCEBA 
FXIYD TKZSP . 


9. VJLUO CGMDQ ZUUQA WIFOT RENXK ONSWQ AJUII NBCQY PPZCD KQMAL 
JYLJQ ZOGTK . 


10. LSIKK LQNXO DPOHK FVTWY FMSJN SFGQQ BMHPF VUJLM ROKVW OWVJH 
JYJHP TDHEH . 


11. JBBPT CHYHK QXADK KMHAV CMKWV HYRXG SXULB IKXMW WTHEM NRLQX 
AVDPG CTYDQ . 


12. CDZRW AIHYH JNNIW SXRGX LKLGT YLHJH PLJOR IBMRO VTVEH KCXAY 
SVGJH GQYRK . 


13. YYZTI UEXQG AEJVP CDGTP DPQVI QZFOP UZEPZ EHZHX TEXAQ CENAF 
ERXYE CBHBO . 


14. GNDGJ LDVGD TMVVY YSEFM QBGGF XXWPP DBPNB EWNID EUUHR VDGOU 
UTSGG NUVLZ . 


15. IDGQI SCVWW ZKMMN RCATK NUYHA ZKXTZ ESNQW GOGKS ONJSE MHFGR 
LGTUB JJXQJ . 


16. CAXIY FTVQK BBKDF BZQJA WGCQX OCNTT OZYLW YJNWT WNPJT GVUCV 
DDLVO KGFGK . 


17. ATHYH JNNIW SXRJC HDOVU KNEGR AXJDK NHMPZ FDRPI UDQDQ JUUOD 
CSMEW RPTSW . 


18. TBKQX ADVFF BRICA MFUWM SGWAM GTECW ZWWHI NEEZN PDRQP VPNHF 
ARWWG PNPAH . 


19. IUNHY NKUUD DLTPD PQVSQ AZAGR ZJZRC MAOQM AMJAP OLZQU TQRCV 
MMUAO WYIJH . 


20. UNKVE IFLTR BDRIJ QWBQO YWIQG UASGR WGIXE PTUCI HWLZV ZUTSV 
WJIRCJ QRJDW . 


21. HJNNI WSBQF PNBKO TCDIG CXCNB AFECS CRDLM NLZMM AQERJ SPTMW 
GUHSY QFSFI ... 





a2. 


25. 


24. 


25. 


26. 


27. 


28. 


29. 


30. 


TVOJUG 
WILKZ 


VOPWO 
BLYKL 
UJIGVW 
OQIUG 
KUMNV 
ZKJHF 


GBPIS 
KTTWQ 
EWIUT 
JRFGR 


CAF JU 
LNEEP 


QLOMK 
ZUKUD 


YDUXE 
XZOTX 


BKUST 
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PDPQV 


KFFDT . 


YWRCA 


YVPWK 


ZCKKY . 


ATCXK 


UCVNA 


WPJZG . 


WNPKX 


QEGQA . 


MKKIG 


GVTIJ 


UFHTQ 


DGIOE . 


ZMXNU 


NHXBH 


CMJGE . 


JHYVN 


IQCMA 


CZBEA . 


ONSWQ 
QGQTT 


VYYIT 


AJHUQ 


ROWNZ 


TTVSF . 


SQAZA 


HGJOV 


OZHQQ 


XHDRT 


AHVNJ 


MNZTY 


EZJZR 


RUMZE 


JZRCM 


GRZJZ 


SZLIQ 


AOMZJ 


IMTYX 


CAWXB 


XGOFQ 


CMAOC 


PRQXY 


AOJKF 


RCMAO 


EFFWJ 


XKPID 


DEUFF 


CXQYO 


LYZXB 


CWXAN 


SEZZJ 


XIOSQ 


AWMFN 


ZNMZY 


AMRDY 


FNKNT 


NGJGA 


MSWWO 


PQCHQ 


QHMIU 


LAHDP 


KNTVG 


MVWCF 


FVKLV 


VGLGB 


YJHPR 


XVGHS 


DTEIE 


JVCUU 


QSNQV 





LVIET 


IPWIJ 


TEFJL 


BQUFY 


QESSA 


FNMUR 


SMRFB 


BSVNB 


WVPYB 


=oneR= 


ESMOF 


FXCOQ 


LZKUB 


RWGRN 


YGNQD 


AWJSV 


ZBNXI 


MYXSZ 


DURIT 


b. Extrapolate additional key from the foregoing problem, and recover the complete plain text to 
Message No. 30, which is given below. 


YDUXE VYYIT EOWNZ JZRCM AOJKF 
XZOTX TIVSF YONAI WTAHK LFFLC 
PLZEJ RQEQB FCDIW BJQST 


XIOSQ LAHDP QSNQV WVPYB DURIT 
CVHJH HLHFR LYZNB OZMEB ATIWO 


8. The following cryptogram is suspected of having been enciphered with a key derived by some 
sort of Fibonacci method. Solve it and recover all keys. 


84360 898435 
45713 QSSTT 
09178 84673 
50745 28901 


23654 
69960 
95453 
84105 


99422 
67340 
29051 
44839 


11271 
88260 
T1193 
'TA867 


04825 25759 41545 
13590 51375 067'70 
42329 56490 O'7AST 


34591 


E. Cylindrical cipher devices and strip cipher systems 
(Embracing Chapter VII) 


81196 
62070 
59137 


65525 
38254 
78351 


1. The cipher message given below was followed by its original plain text two days later during 
World War II. Reconstruct the cryptosystem involved. 


MCSGO HKXVS 
QQUPC XCSDJ 
NJGIM FKJINZ 
OLCKC CWZJM 
DCQJK HWKGD 
ZPPXQ MHTIU 
MKNNA LNZIF 
FKNUW QFZFD 
RBYOM KDCHR 
QKEMK ONUKD 


QFFKW 
EJZUZ 
KTXCQ 
FPAQL 
RGQTK 
IPSUM 
NVHUT 
YYVNK 
QDBMI 
MQLCT 


TFILU 
UPBSA 
RBWLW 
QWQSE 
ZOGNQ 
XSITS 
KHPTD 
XKKPU 
XCRYU 
DEXIA 


ODLLZ 
NEZLE 
KDMWH 
RDRET 
DOVRW 
IQKLX 
CDBXV 
YQWCV 
HXKMF 
AXFLP 


625 


SQSVM KWOLY 
ATKNF IFCMI 
LTKHZ GEAFC 
AEQJO NAXEV 
LXNDF XHCCP 
BCIUF MPXZB 
LYBQV ZZBUL 
PVHUP WJBXM 
TYELW MPXZL 
HWPEW EPVDH 


HBXFO 
MFWNM 
MGKDA 
GZRPG 
YJRNM 
CWLVC 
NXBOC 
ABYVW 
CEVNV 
IZQFJ 


GJGGW 
CXWRK 
LICUD 
YKLRX 
VZIAI 
QZAZI 
KWTCF 
KMIGM 
KQPQW 
PAMRE 


YTXUP 
TIWKF 
IPXHJ 
XOKVY 
XOHRU 
NDWTE 
OFEZF 
ZXGKS 
TWFGK 
ZYCXT 


eneGhinies 








XOYSV 
IGHTF 
XQMDM 
LFMTQ 
MBNJY 
KBUGM 
RVBLK 
RHMTQ 
PDMSL 
MCPBI 
PCLJU 
EXPTB 
UQGHT 
YGJFN 
CMKFM 
PWYJR 
BMMSC 
GOPZB 
NSCUJ 
XEASN 
PEF QB 
WSRDH 


AUHSA | 


UBZPQ 
VAKVE 
CUNLO 
QQEAK 
PKUYS 
GPBJC 
HXTIW 
XJEDM 
MNIYX 
LYOTW 
SNKYJ 
GKSEL 
AUHMD 
EUJED 
QFUKF 
LKPXZ 
FCRDC 
NUSKU 
PKEYG 
WOHXH 
QSGAU 
SNSUG 
DGZYW 
PDFYK 
XSEZO 
MIPUO 
BLSKL 
XRSIK 
YOBSY 


TUVQQ 
VENZE 
NBGOV 
VXHLH 
FJVSK 
DRLIQ 
ZQLQA 
WUZPM 
MIWFA 
KXMTX 
VXSBU 
ZUHDP 
SEZJIC 
MYDGP 
LKSWM 
GONUK 
YXCGE 
BYCYG 
UHLZQ 
GCEUL 
SHFLG 
DLZSE 
LBWQL. 
ZPVMP 
KESPZ 
UMQGN 
KGJVO 
WWYNX 
TTTNM 
OKWAY 
XGNQT 
ATYTG 
QQXDN 
LQKVY 
HDJDE 
EPORY 
MXQUX 
YNNZR 
BCPFR 
EUGBT 
DLVGY 
MSNCR 
QVYTR 
EHXIV 
GXALQ 
LWFMS 
GANWC 
IDEYL 
SEPCI 
ECQMF 
ZEKSI 
ZUIUS 
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WDSHC 
ROATS 
HDNRG 
RHPFO 
XKKPA 
YZGJA 
YMVUY 
CMHKV 
TYZXU 
NCIRR 
YNIPG 
YINCX 
EEFKL 
GLPBN 
THLKL 
OHTTC 
PPMHG 
OWNCX 
ENVSO 
CKTCZ 
MMICF 
NVPUN 
KFFEU 
IBJTO 
VKSPE 
OQCQX 
UIPEZ 
VFAUJ 
YUGJT 
ATAOP 
OGGJG 
VJCCU 
VXGGI 
BOGXD 
AIVNS 
LXHGI 
GOLIX 
PGHGE 
YQZLD 
CCTWX 
NKZDH 
SKSLL 
JDIOC 
KMOEN 
WLWDF 
NXEBS 
CJTTT 
OQRJIW 
XNHSC 
DCKKE 
ALASY 
GWUTY 


EEZKV OLJQR 
FONEF DRTCO 
EPPJQ LXIVM 
NHMWB CMKZS 
USJLO XLANT 
SACKT WSRDG 
IWMRK ONFPG 
JLHLE HMMLN 
VWVRG ATQLP 
QEAUH KOTZY 
GYFJW PGJFB 
AZGSU ZAGAE 
HJXPL MTQOM 
NIZCL KBUGX 
SBDCY SEMPU 
JNEUK UNQSL 
VUSJC IXMWL. 
AZGWU WKAPJ 
TBVYZ SJGMC 
FAKXW MOXDP 
GKVPC SGDXZ 
RIMLS TGWZB 
RDJWA AAMLU 
LFMSJ GYXSE 
ESSAN SVHAK 
QPEOY WULEX 
ENGHY IVMWQ 
JRNETI OQZFX 
LDHHO BFTYP 
MRCAG LAHAM 
GHQJL OPVYE 
CINBH BJIRZJ 
WXLVC TTLLY 
HHZAS KHBNM 
YKWBM ASLOT 
WAQTW LBPEX 
SMSTV HMIZD 
TAKJD CGSLI 
TKGEE AVNPG 
EILLG CYULK 
UWRHU OJDTH 
UGKJZ BMEAV 
BZMBD TXXCS 
BLFCU PPFWR 
VCLOY GVROU 
TQAWY SQCHU 
YXABU TWLJR 
WYXGD DBAMN 
LOMNY TEFUT 
VGVEY SQZLS 
QDHAQ HGHCO 
IWMRC WTEGW 


KHIMO 
DSYIT 
EIFLV 
MLVNT 
JVPRE 
WVAKG 
WYAEG 
SQWOQ 
RMABF 
OKVFD 
YPHDM 
IULFC 
EKXAJ 
KTFZN 
KAVOT 
RJSJT 
HOIVY 
ZIRVV 
GMYKY 
GQYWX 
YUDYK 
OIXHW 
GKABS 
BHQHR 
XZPQD 
YQYAS 
ABNAJ 
YQPGZ 
KRSGI 
YAHFD 
QVXCP 
HETXO 
ABDWM 
KPJXO 
TNGJE 
PPKFM 
JQKHW 
MIOVY 
CFAFU 
IWXTF 
GINBO 
PGHPQ 
WJADZ 
PYMIJ 
WSEOH 
GWWMS 
DOSTY 
WVGYZ 
CFNTD 
NKZEY 
HYCZT 
MMWIR 


XVFRS 
EHMKJ 
WXOLX 
ZENEO 
QKSFZ 
MJJPW 
UKLSC 
KJEQB 
VXVNR 
FHBWD 
IQPYP 
VODSM 
GOAMF 
DDUWZ 
GBIEY 
MDVWC 
YCHPG 
WJISJB 
NJMIB 
LSOJZ 
WLHWB 
WHJCX 
HLF VP 
HALKN 
KGWSA 
JIPIW 
YNSYV 
AXOKL 
CQNUS 
MBGOY 
IUSOM 
FACDV 
EKFZE 
DKCZZ 
JRSGA 
JUVFL 
SKMID 
YCHPG 
VPZDY 
OXWFC 
SMCOM 
QTCAM 
ASXBQ 
DXJAP 
UBDSE 
JWVAZ 
LGJZO 
SGEBW 
PNUVS 
HDYIW 
EKHKF 
MUTTX 


VIXCX 
TWUKX 
UTAQE 
TZQGG 
NWCYY 
DXEVT 
AJBGI 
HZZWX 
WNVFK 
KVBQT 
QFCJK 
KMQIM 
CFTEU 
YOHDB 
ZDNEZ 
JAEJT 
ELTMA 
KVPKJ 
RJEGQ 
KELUC 
LUSUM 
UTAQA 
IMNPO 
AHRQI 
IJZYJ 
WPXHK 
FLAXD 
IJFGG 
QEKCI 
UYHJV 
EWBWS 
EOFGC 
GBWVS 
RGIRX 
HYXZD 
TAUPD 
FTHBX 
ELWHS 
ATRYZ 
FGNLN 
MXNHP 
VZ0Z0 
KGWIO 
BJSAX 
PWQAQ 
CTLQB 
XQANF 
DXTCZ 
SQAKS 
YTCPB 
WLJZT 
WPVFJ 








mGbS Ries 
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QEJAP JWYST FYBXN LWEGO KPMDI NQZYQ JOOHK VSOEB JJYTG ZNREV 
LCELQ KTFSH OPAJA LAHVX XSLEP ZBZFV NWOPX FBUXF BBZWR SFSHZ 
KDWJB AKVKO UZFUY WCDWS TMGQR EUPAG ZOLVV QMIIA IIBKQ DEAUQ 
AJENO COHOQ UJNIF OZXRG PDKBP KOIWL VVUMQ RSVJC QZAZB RLLDM 
GLMKU 


The original plain text of the foregoing cipher message, as it appeared in the teletypewriter copy: 
RE TELEPHONE CONFERENCE 32 CARS AS FOLLOWS COLON 


B&O 380083 4005593 470 199200 15980 82700 1833 
PRR 78708 4005594 470 201-2 15980 82800 1833 
MILW 18844 4005595 470 203-4 15980 82300 1833 
MILW 19647 4005596 470 205-6 15980 82900 1833 
C&NW 73692 4005597 470 207-8 15980 82900 1833 
C&O A167 4005598 470 209-10 15980 82200 1833 
B&O 380579 4005600 470 211-12 15980 82900 1833 
B&O 379021 4005601 470 213-14 15980 82600 1833 
TRO 54682 4005602 470 215-16 15980 82600 1833 
MILW 6442 4005607 376 217-18 12784 66500 1466 
MILW 18081 4005608 470 219-20 15980 82600 1833 
MILW 18470 4005609 470 221-2 15980 82800 1833 
ATSF 143641 4005610 470 223-4 15980 82300 1833 
RDG 103285 4005611. 564 225-6 19176 99000 2199 
SOU 306570 4005612 470 227-8 15980 82200 1833 
RDG 19102 4005613 470 229-30 15980 983200 1833 
MILW 19545 4005626 470 239-40 15980 82900 1833 
Gw 45019 4005627 470 237-38 15980 82700 1833 
UP 75308 4005628 455 231-32 15470 80200 1774 
WAB 83552 4005629 470 233-34 15980 82300 1833 
NYC 132442 4005630 440 236-45 14960 77000 1760 
MP 42680 4005631 445 241-42 15130 79100 1735 
sou 261700 4005632 470 243-44 15980 82700 1833 
NYC 151707 4005670 470 246-47 15980 82800 1833 
WAB 83350 4005671 470 248-49 15980 83100 1833 
B&M 73104 4005672 425 250-51 14450 82600 1657 
B&M 72108 4005677 440 252-53 14960 77100 1716 
SSW 33571 4005678 470 254-55 15980 81100 1833 
CB&Q 42072 4005679 352 256-57 11968 65600 1372 
CCCRSTL 48835 4005680 430 258-59 14620 78000 1677 
WAB 82452 4005681 440 260-61 14960 77000 i716 
C&O 2418 4005682 369 262-63 12546 67900 1439 


627 =erentT™= 











DO NOT WRITE ON THIS PAGE 


2. The cryptogram below, enciphered with the M-94, is suspected of beginning with the word 
ENEMY. Reconstruct the plain text, and recover the sequence of disks and the literal key upon which it 
is based. 


GDYUB ZIBHN IUJGQ ZUXTC ZBDRO DRRZM LCXTO LPBOR JELHM GYGAU 
AODLH CNBTU ZJRVL HQUNW DQHZB ATUPF VRLHL RFKUV UAAHG BEZHU 


3. The cryptogram below, enciphered with the M—94, is suspected of containing the word HEAD— 
QUARTERS. Reconstruct the plain text, and recover the sequence of disks and the literal key upon which 
it is based. 


NEKYL SRQXV EEZHP VGTUT YJXBY APKVI RPZNJ WWFXE OBXDB VQAYZ 
ZDJGM MFQGX LKHIW BVDJK YARBK LLOLO OYOVD FARUX ZVXBT GMAUV 


4, The cryptograms below have been enciphered with the M—94. Reconstruct the plain texts, and 
recover the sequence of disks and the literal key upon which it is based. 


Message ‘‘A”’ 
YXI DE RBV 0405 26 DEC 
QVQQK YMYRK FEOPM 

Message “B” 
YXI DE RBV 0501 26 DEC 
GNNSF IDOOX HQFQQ 

Message ‘‘C”’ 


YXI DE RBV 0612 26 DEC 


RKNSG QPNIS OBWHC AWLZU ZIVCB DRUFW WMRQK GDCXU DIFKB OSTZN 
FCLCM ADOEO EHAAX JGAWP NRKZH NGPRG HCBSL RSJCR WGZBI NVABP 


FE. The Wheatstone cipher device 
(Embracing Chapter VIII, pars. 49-51) 
1. Solve the following cryptograms and recover all keys: 
Message ‘‘A”’ 
PIBRQ HOCDP VKIKZ XKTLZ WYPFL LYEQO NBVKX VWXTT 
Message ‘‘B” 
KIMLP CAGHX PKXLR UZLGM SVMMC KWKMO 


2. The following cryptogram is suspected of containing the word HEADQUARTERS. Solve it and 
recover all keys. 


GUGVD YVCOM NPHTE MXZED HIOWA SNXYT SULEI xXQNTQ GTHYH WRVFR 
ZLRBA FUPSJ DSCTF HFUJY SBSLC RWCAO OPDLD EIPXH WWYTZ UWEEY 


Oo 
tw 
em 
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3. Solve the first five of the following message beginnings and recover all keys: 


OONOOAWNNE 


DMOMW 
ZODFF 


QODFF 


GGZZI 
PPRVT 
ZOUYR 
JOSBE 


OXHZH 
QODYV 


10. JOSOZ 
11. DMOMW 


dee 


ITATKR 
QOQTY 


GSVRO 
JDUVC 
RDCUT 
KADGX 
NQQDR 
JIYOB 
soqqu 
KSHAV 
BNFVD 
UIHUA 
GQIUT 
VFFID 
HTSNF 


HDKBD . 
XZNHE . 
YRKNJ . 
QUYAN . 
NYNHC . 
WYQWP . 
KZLBJ . 
CFKZL . 
CVJSO . 
TUDRN . 
RQLYK . 
TBMFT . 
KZTQY . 


EQRKC 
PQOFS 
JXZRK 
QOJKM 
AMROC 
AMYPZ 
QOFFR 
SXXRV 
QOKXI 
DBHYP 
MXEYT 
NXIST 


QYRES 
RJIBR 
CYSZD 
YPTIX 
QVKAQ 
XIUCZ 
TTIAF 
YJHDO 
FROJP 
HNLAD 
RTVAT 
NQQDR 


TBRHR . 


OYKGJ 


BUHZW . 
IYZQT . 
JKOVL . 
ZOBNM . 
OZYWP . 
PKOYA . 
AQBBO . 
AYZJM . 
DMZNH . 
NYWGB . 


4. Solve the first five of the following message beginnings and recover all keys: 


OONDAANNE 


10. 


FUTJY 
WWZMP 
IBVEB 


HRLQA 


GRFRF 
DDRZL 


LDLIP 
BXQKC 


CXHMX 
CDMZE 


ll. GIHCN 


le. 
13. 


CSLBZ 
FOWYT 


VPFAR 
GRGUC 
TXCMR 
CWAYB 
WDHLG 
OYOAE 
LIPJU 
QSWUT 
WKSEI 
KWCHQ 
JJYOI 
DILSQ 
OYEZX 


RRNVT . 
QCPLC . 
TOXEY . 
STCHD . 
YJPVH . 
KELSN . 
JYLIY . 
XUYNK . 
AGHGO . 
MQVUW . 
KFKNQ . 
FKBEX . 
DVTXN . 


14. 
15. 
16. 


DLWTK 
WVWHA 
CSLBZ 
ZCJICQ 
WOUIK 
QFCIG 
QSDUK 
NLGQT 
DMGMR 
LSQDG 
VFUAO 
ZQYQV 


5. Recover all keys from the following matched plain and cipher text: 


WAHJJ 
REFER 


OHJOP 
DPOST 


ROESP 
DS*NO 


MTOVL 
ENCE* 


ESPQH 


*NOW* 
JYRPL 


RTHEA 


LHTEX JCWQC 
YOUR* LAST* 


SYONH EWXBV 


LOCAT ED*IN 


FGLGX QEBIA 


ST*OF *ROAD 


WLJHZ 
MESQA 


CADWX 
*SCHO 


RAVSX 
JUNCT 


WQZPX 
GE*SE 


BEMOE 
QLHOU 


QXGZP 
ION*S 


6. Solve the following cryptogram and recover all keys: 


GDRYL 
UKVUQ 
VYUEF 
ISKCR 
FYHIH 


RDTVO 
HAFZU 
XAVAF 
QBSIC 
OJTLO 


AHRHO 


KGETG 


BNWZN ULLAS 
JWTUW OPNXB 


GYVKJ 
SPSUM 


FINYO 
QLBHJ 


YZCAL 
NUMQS 
RQDTJ 
EGWVW 
ZSIDA 


BPMLJ 
TNXCB 
CMISE 
HGJPH 
QPQNI 


7. Solve the following cryptogram and recover all keys: 


WOVAC XPLDV KZGZU ZDAOD ANTQI 
BARXF TGOZV RQMCY MPLSV CQCPH 


629 


EPIUA 


AOLHS 
COND* 


EOSFE 
SE*TH 


XRILU 
EVEN* 


DBJKW 
JVMWP 
MDAGJ 
UHOJH 


QUMAR 


ORYKH 
REGIM 


RZOWH 
REQ*H 


NRQRD 
NINE* 


GCOFB 
QERKZ 
PRSAR 
ZEYAH 


WOXFH 


RVITG . 
YSSTD . 
MFMTB . 
BSPVE . 
ZFRKD . 
WLFHZ . 
BCNQB . 
RDHVR . 
UADVI . 
CHABL . 
IRQSF . 
BXZTS . 


KCDAG 
ENT*C 


NCXFU 
UNDRE 


ZKEGS 
EIGHT 


MZBOU 
POETC 
LORNH 
ZDELV 


PLHMM 


DNKPZ 
OMQAN 


_IMMVD 


D*YAR 


WLDDY 
*STOP 


GJHNH 
MHOGD 
HPKRN 
KFTTE 


FQKDG 
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G. The Kryha cipher machine 
(Embracing Chapter VIII, pars. 52-55) 


1. Solve the following cryptogram and recover all keys: 


GWTJB MHYWB EGWKR AWRLA DXYZW 
2. The following cryptogram is known to have been enciphered on the original Kryha cipher machine. 


Solve it and recover all keys. 


JYBTP 


hPa ExMHAe 
HEA EONA 
Sham AHS 
AONrPHAnDA 
aM MOonDAH 
HMONAHHS 
ZoOotarnds 
SM BAO Bo 
MMANtOD 
—SHAAOnRMA 
CHA rLoO-|” 
HNANNEM<M GD 
~HZOaUN AN DP 
MHOEOUOGHO 
Arye DOSS 
IM eaMOPA KB 
QoortdoQb pm 


FYMZWXGVVI 


19 


QRIJITURJIY 
DYWMJIMOW 


XG 
AU 


EN 
Ca 
= O 
N <& 
AM 
oa 
> 4 


Sk RHR AN HED OD 
OH MMAR DHNHON 
HOonrVostHsaodny 
HHONMHNTSCEN 
AMUMNUBDEnN BE 
HHOQNMEDHAaMmM ara 
BSS EPAPHRANRDOIAON 
CHSeOTMHNH SN AOM 
Hx CORBZMACRHRAOND 
rPADOAP ASDA 
MEA MAHUMNAAHaA 
TAM HHeM EFAS!” 
PHDAOVANMMH AD 
PM AZOHMUHROCCAOR 
OPPrPAarasnnneid 
aatM PrP SOM N Ae 


EO xX 
Ew Oo 
Aa 4 
Z2ON 
ats 
O me 
a 
=m 
ane 
WAH 
hy Ae a 
HN > 
man 
PP 
epA 
Pom 


PHNPADOAANHNHNE 


ei 


N 


nN 


20ND SH 
HO OaH 
ONnkKmOD 
ne uN O 
BH > HH 
Hmoe@WaA 
>rCeAN 
Ram M Oo 
KU mM mM 
Leow 
omnrd 
km DOO 
OHREA 
DONDS 
=a Oe SE 
SON Dk 


EGRNDDNFCXHYJ 


0 
Q 
N 
Q 
Y 
F 


MAHOMDS 
OHDUHAHRD 
maMmO AAA 
Matosaxon 
OCAZNAND 
CAZNASMA 


Haq Ee oN 


BHODBODHSM 
BOMHNPo 
MONnNAMMN 
SHAE A EH 
Ot TMHH Ss 
MPN Sme 
HroNBE 
HE SEAN N 
MNMMANYD 
pPhna sno 


™ 


OH 
<N 
BG 
or 
fy P< 
H << 
=A 
O fy 
CoN 
oU 
Au Ay 
fx] P< 
2 = 
am 
> 
or 
Np 


wi 


NQNAAN 
Oe 
EON 
oo Aa 
ton 
O A. 
wo 
aPrPok 
hn 4 
Leen 
Ak MH 
-ods 
HAA 
waCH 
a EN 
NM D WY wy 
Lorywsawas 


ADGRBZLXGUTFMY 
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8. The following cryptogram, known to have been enciphered on the original Kryha machine, is 
available with its compromised plain text. Reconstruct the components and determine the disk setting. 


SNM 
M WY 
aN 
“= 
am 
up 
m& © 
SA, 
Fe fy 
ho 
mae 
Co 
2 OG 
= 
= fey 
A 
om 


> oO 
Or 
oO 
N & 
Cr 
om 
ao 
ae 
fk. mG 
p< 
= 
Cs 
AP 
oe 
WY Ey 
to 
og 


m 
~A 
Pa 
oO 
O > 
am 
HW 
Ne 
>a 
azo 
oa 
= fl 
pte 
nN 
=A 
EA 
at 


PD 
Ho 
mt fx] 
mm 
Po 
a& 4 
DQ 
m A 
™ Oo 
CH 
on 
mm 
= ky 
BM 
a 
OO 
ato 


AM 
fy 
oo 
Dt fa 
A 4 
oo 
O 
MD 
>a 
wo 
aH 
> 
=H 
O& w 
mH 


@ 4 
An 
aH 
AE 
= 1 
oO 
BIH 
MH 
py AL 
a A, 
1D 
= 1 
= WY 
ZO 
aH 
Ea 
wo 


ca 
na 
xP 
oe 
4 
iy Hi 
na 
OQ 
oe 
= & 
CH 
2s 
BM 
HP 
> 
<< 
eM 


ata 
ot 
Ooo 
xD 
eo 
mt 
oot 
m4 
Au iy 
LH 
Qa 
go 
RH 
<4 
AA 
ADP 
om 


Mz 
oz 
Nn 4 
oo 
oD 
ap 
Oud 
Of 
Aa 
op 
Nn 
B yj 
Bg 
HS 
=m 
HO 


om 
>< 
M4 
op 
Zao 
AH 
Oh 
am 
os 
mm A 
a fy 
xo 
on 
2O 
On 
Gu 
ow 


mM WY 
oy 
ou 
me 
wo 
a 
AH 
MM 
& oO 
oo 
py 
yn 
BR 
NO 
QA 
= by 
AA 


HY 
HH Ea 
Om 
og 
Ay 
P¢ +l 
a 
AH 
oo 
o 
> A. 
= V2 
os 
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4. The message below was enciphered with the improved Kryha machine. The I.C. of vertical 
digraphs on a width of 21 of a volume of homogeneous traffic (see distribution on p. 634) is found to be 


1.04, whereas the I.C.’s of other trial widths are in the vicinity of 1.00; therefore it has been determined 


that 21 screws have been activated. Solve the message and recover all keys. 


15 


CSTWIZYZXIYMVRMZT 


10 


O 
wn 


OH 
<M 


CAD 


Op 
ro) 
or 
PD WwW 
OH 
oa 
pa fy 
D> 
uN 
> 
eo 
am 
mo 
ao 
ao 
Be 
Co ix 


RBLPXBJZRYUL 
CNREALSJJIVA 


QV 
OF 


0 
W 
QYAPPCSKFTLSVEGMN 


TZITYWTUUILLMYGCC 


AS 
2m Wn 
a> 
m*' 
m= Ay 
mM fy 


EGQ 
FXX 


ma 


ma AH 
EFaN 
Mog 
mM oO 
HMO 
He N 
ask 
OR & 
CUM 
> hs 
mM NM PS 
MOH 
RP & 
Hea 
mo 
mae 
ouUM 
Bor 
oeWD 
NHO 
a) 


PAMT2M6MAABMEDMOHRE 


BHRPNOMAMMMHNASE AS 
NNSAAMNMHHAFPAHNMDCH 
ZOMG hoD rR A VACH MM 
HAF AMMMADOAONHD DLE 
BNUHMMOAHKDAVOARAUUNM 
OUONMEENAHHONM YS ODES 
MAAOBBPHONHIAZHNMPESD 
AXMHAINANMMAOCHARHMODS 
HNAGROHONE HH MHA A 
SZ2AaMMNNOAPFPASEPMAMHE! 
BODGHHWHFAZHMAH AAAS 
BRDOGHASrRPOMHRAZ HAS kh 
SHMASANAD ASNMNHONNS!| 
OQNAHKMNANHRETDOHADS 
mMANMHDNNONRAUINMDS 
NQNHAENMNHHABMOONODE HM 
BROBAMEAUNNHHN MAO 
MHATMONDFDEAHHEWONSE 
SQ r>HDTehRoZaAnRANA 
HMMATNSE HAAN SH OCHAH 


BLAMAUONSE 
EMH S> MH aOO 
NAwAeroOrMsA 
HOhHHAHOSs 
HHOAEFRHH 
eHOANMIDD 
CHA AAMAS 
Mem dooriadt 
HomaAas2anrm 
Late eHeE Dp 
NeHAmM MA 
GVPONRANH'S 
ARHOXMOUGD 
MAHHNNANA 


Dy 


ON 
oO 
AS 
i m& 


MQE RACH SE 
NOUR EOS > mH 
SEHAAaOUMNO 
NArHoneEe 


OOCHUCRE AHN 


n << 
| 


AN@GMAHM> 
BROLAHAS > 
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5. The following two messages were enciphered with the same components as in Problem No. 4, 
but with a different screw pattern of width between 18 and 25. Solve them and recover all keys. 


MXBJW 
NCKNG 


MXBJW 
KNIYT 
NEUCF 
ESEDF 


SBSSO 
GILGT 


SBSSX 
HJLGT 
PHTVL 
ZZKEM 


VLULG 


JHXRF 
FGEPP 
HNAKV 
FZSDN 


ZBJVD 


VHGKN 
VIIXW 
VBXYW 
DNDOT 


Message ‘‘A” 
JQTBI KIEBG 
Message ‘‘B” 
KLUJT XHUAW 
VZDQW HVPZX 
NLZXB BREFV 
YKVJD XDGSD 


UWOYT 


QNZNR 
EDJRP 
KIVSK 
IECYY 


JDSFL 


UUWUF 
PBDMA 
CYQLH 
HJZEM 


HKVCR 


OQAOV 
FXBOL 
JCZNT 
OAXHD 


LGKLF 


ZVPZV 
JKBNA 
BWNDE 


6. The following message beginnings were enciphered on the improved Kryha machine. Solve the 
first five beginnings, recover the original enciphering components, and determine the screw settings. 


ODNOTANNE 


IZZKK 
YZNDD 
PDNUG 
ZULDD 
WDFPK 
PDTIS 
ZMCDH 
WVJXP 
PDKRR 
IZZKK 
QDNUD 
YZNNG 
HVLUR 
YZNDD 
PDYND 
ZYPVD 
KVXCB 
ZRYNG 
MTTTA 
PDDVP 


FSCHU 
CLZCE 
ZEXBO 
YXJBM 
PMXUW 
OLXBO 
VXTCY 
WXDXL 
ZEIXM 
HMIGE 
JXRPP 
PMIPE 
ZEIAB 
CLZGY 
XMMLD 
TKMAP 
XKCOXL 
ISOML 
XXCLL 
JSIPE 


RASBD 
WLSXD 
SFMDI 
EBNKL 
KELGH 
CFSCW 
LHRTD 
VWFCN 
LWVDY 
ZCAQV 
KWWQM 
KNRVN 
CFRDL 
WEWFK 
RFANY 
EBVUF 
AWYRW 
BIGQK 
RQRJV 
KVIRO 


BMEED ZMRSL 
BNEEC ZHSMR 
ITCSA ZERAL 
QDWXJ PFYMV 
TGFXH UHSCL 


JTBQD SBXQH 
BVTLJ TIKYP 
JZWSM UAGSZ 
BUIQO COQDJ 


GGWYB TIKYH 
ITAAF YUXAT 
WGAHR BABMO 


YZCMM 


CMJ JU 


SJJSM KXXVW 
YTDLK NUIDF 
INWLU RACWF 
IZJGG CMXIE 
SMEER ZTFJIX 
BHJAR ZMCHF 
HDSST FTBZE 


SNVIF . 
SMNQV . 
SHMHZ . 
TNNWW . 
DOSME . 
AZRTM . 
HAJFF . 
BEXJW . 
UHFGV . 
SNRBV . 
TZJAF . 
TATPY . 
LHRRF . 
YPUIL . 
BNWWD . 
NZEXV . 
EHKXS . 
TNBGS . 
EXVIP . 
OYXGF . 


7. The following cryptogram was enciphered by the machine of Problem No. 6, but with different 


components. Solve it, reconstruct the components, and determine the initial screw setting. 


TNFDL 
IDFFM 
BDQNQ 
WEGZG 
XMUPH 


XHDCJI 
PINYY 
YHECI 
MMNPL 
YSVFW 


DFKDP 
NAIYI 
PRERA 
RFSYT 
QBOUY 


PIEVS 
MJRXO 
ZVPKV 
BKNAF 
XVZFY 


IWOosJ XQRJB 

BBYRB WVYBL 

EDFNT WJHVT 

THRFR GFLZQ 
633 


EPLMC 
DURMG 
QQULC 
VBSNT 


KFXIC 
RIHRS 
UNOUD 
UXRDT 


VYVQY 
SXYLB 
DKZIR 
VDKCK 


QBUGH 
XEQBG 
KGERC 
KGPKS 


Problem No. 


A 


NSM SS CHNDOVOZSMPAGHTNQYAAVAWS 


B 


22 
21 
2i 
23 
27 
18 
26 
20 
15 
41 
23 
20 
17 
29 
17 
17 
18 
12 
30 
21 
22 
17 
20 
19 
21 
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4: Vertical digraphic distribution, width 21 





c DEF GHtIds KELMNOPQRSTUVWXY 24 


14 23 
34 16 
19 17 
16 41 
18 33 
22 18 


13 
28 
25 
li 
ig 
31 
31 
32 
21 
22 


18 
43 
19 
15 
16 
12 
31 
12 
14 
16 


16 35 
27 21 
20 24 
10 18 


28 
27 
Al 
26 
17 


24 
23 
i7 
il 
35 


15 26 


25 
2T 
20 
28 
17 
18 
19 
20 
16 
19 
21 
19 
19 
18 
235 
21 
19 
13 
22 
30 
21 
27 
19 
27 
17 
22 


18 
24 
15 
31 
21 
235 
17 
16 
26 
24 
4l 
21 
15 
20 
16 
19 
ill 
21 
14 
11 
22 
26 
14 
17 
26 
26 


19 
24 
21 
18 
21 
33 
24 
24 
31 
23 
20 
235 
30 
20 
26 
22 
22 
18 
17 
14 
18 
24 
24 
20 
27 
31 


25 
24 
21 
13 
35 
20 
16 
29 
48 
15 
31 
17 
24 
17 
16 
22 
11 
17 
36 
27 
10 
17 
18 
13 
36 
24 


17 
18 
15 
17 
2T 
31 
17 
17 
15 
17 
32 
27 
52 
26 
23 
al 
36 
16 
24 
24 
24 
21 
26 
25 
23 
31 


20 
30 
23 
22 
28 
22 
19 
23 
26 
13 
16 
19 
16 
16 
13 
42 
i6 
22 
19 
25 
17 
23 
33 
17 
RT 
22 


24 
24 
22 
25 
23 
34 
16 
25 
20 
22 
16 
17 
25 
22 
28 
19 
35 
28 
24 
32 
27 
37 
18 
18 
20 
08 


359 
18 
15 
25 
15 
32 
19 
26 
37 
18 
18 
17 
11 
31 
13 
19 
30 
12 
16 
20 
15 
27 
18 
34 
eT 
16 


16 
20 
21 
32 
19 
al 
25 
26 
21 
28 
30 
14 
25 
20 
16 
31 
eT 
34 
09 
20 
31 
44 
14 
19 
10 
17 


18 
12 
27 
13 
34 
19 
27 
31 
31 
2T 
25 
26 
37 
18 
31 
21 
28 
25 
14 
33 
13 
21 
25 
19 
21 
18 


22 
29 
26 
24 
22 
16 
21 
21 
23 
16 
RT 
23 
UY. 
19 
20 
15 
22 
24 
30 
12 
25 
el 
20 
15 
17 
31 


1i8 
16 
27 
26 
22 
20 
17 
23 
26 
20 
19 
16 
17 
16 
13 
23 
24 
18 
16 
21 
24 
20 
16 
30 
14 
28 


22 
15 
20 
1i9 
14 
12 
15 
24 
31 
16 
Re 
18 
22 
13 
17 
13 
37 
31 
15 
13 
18 
20 
18 
22 
36 
19 


26 
15 
26 
24 
25 
17 
31 
27 
25 
21 
22 
20 
19 
19 
33 
19 
12 
30 
21 
21 
21 
22 
23 
31 
29 
24 


24 
17 
20 
13 
19 
18 
39 
22 
25 
09 
20 
25 
15 
32 
18 
25 
20 
21 
19 
RT 
26 
27 
27 
24 
13 
30 


25 
21 
20 
35 
32 
25 
21 
27 
16 
2T 
20 
22 
16 
34 
17 
20 
14 
28 
19 
25 
26 
22 
21 
24 
20 
16 


17 
18 
22 
15 
26 
17 
22 
Re 
R2 
19 
30 
38 
20 
24 
25 
17 
22 
21 
19 
24 
11 
22 
21 
25 
22 
32 


35 
L3 
16 
30 
23 
eT 
37 
15 
39 
13 
14 
ee 
19 
30 
25 
22 
16 
18 
19 
22 


30 
235 
24 
26 
22 
18 
eT 
19 
21 
22 
18 
12 
20 
26 
eT 
21 
26 
32 


18 


22 
26 
20 
17 
16 
28 
25 


26 
25 
25 
25 
19 


21 


15 
19 
16 
25 
17 
19 
13 
25 
21 
18 
19 


“15 


18 
is 
39 
22 
17 
18 
20 
22 


20 
25 
15 
24 
20 
11 
26 
13 
13 
24 
24 
27 
21 
29 
20 
20 
20 
24 
17 
13 
19 
21 
20 
20 
18 
22 


16 | 
21 
40 
R2 
25 
So 
li 
20 
17 
aL 
13 
26 
17 
19 
33 
40 
17 
19 
21 
20 
27 
20 
17 
19 
14 
18 








H. Key analysis 
(Embracing Chapter IX) 


la. Determine the source or method of generation of the following key: 


38549 40853 51895 56813 14525 40990 25353 59453 59918 56585 

45655 62505 49995 22508 56529 09312 21449 38938 81253 54453 

05408 533590 81450 85814 40519 91351 35470 85653 58956 08551 

80808 59561 81051 44571 12901 09540 535895 80852 135956 41018 
b. Determine the source or method of generation of the following key: 

69424 34901 07748 11480 43778 07703 42047 67437 49034 80664 

97876 97569 47845 44569 45947 43689 09649 49941 06732 64694 

54849 ‘70335 03867 43745 03449 20375 94173 43736 94594 ‘743568 

90964 90334 338456 07594 17343 75096 ‘78146 84114 80480 04948 
c. Determine the source or method of generation of the following key: 

07453 85663 28647 ‘76529 46394 72266 26147 84030 67151 25768 

01691 65848 23023 61754 31080 30949 41597 03271 ‘79723 35042 

51247 32718 804353 AT7A19 13607 50476 20615 22505 37215 53510 

06115 34462 

634 


4 


{Mn 
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2a. Determine the source or method of generation of the following key: 


781351 ‘76784 31174 50078 76343 AT807 41346 533354 
78518 76441 31917 92478 74179 10834 ‘76033 55725 
46554 653235 41305 86131 34767 30345 ‘77787 48763 
76747 88123 11278 31788 '76503 AT753 17807 67921 
17997 88878 74703 05323 15777 71034 76371 33764 
88390 00666 33300 03985 ‘79531 31533 ‘78342 47800 
34850 74547 83189 


~~ 


..Determine the source or method of generation of the following key: 


VOPVJ AKDXA MTQUG QMOSF SOPXF AEBTA NXHIY RNAQF 
KYLYV HCOMH SAQBK UHWBA SSPIU GDAVT XOYCG YPFKE 
TUFMV ORXXY FHPYR AQUOX ZYPQG AHDPY HRNYL VJEUN 
IGXUN QNOBO 


3a. Determine the source or method of generation of the following key: 


64748 25986 81202 65617 94252 60376 46908 04349 
19145 35989 40208 18269 32025 64609 05138 69604 
78391 19295 '70431 36757 10162 45365 ‘71487 57019 
59560 97925 13767 28020 30481 54247 86821 27353 
89795 23846 


b. Determine the source or method of generation of the following key: 


ENKZU HNZXN ZPCTJ CCHLD BFXHB DURKD HRXNL EZJPV 
XGGYC UEKDY EUBFP UYFDJ CZKBG PRDBP ZBPSA XEAAD 
GVDLZ BIKSK OWCRK WQKWI NVPNN RYLGM QRGLC AOLRA 
ODHOD VKITK KAFYJ EHAJY NBZYA BHOFX PESQF UEQVE 


4. Determine the source or method of generation of the following key: 


FWNEV MDUPG XOFWN DULCT KBSHY PGXOF WNEVM DULEV 
ARTZQ HYPGX OCTKB SJARO FWNEV MLCTK BSJGX OFWNE 
ZQHYP GXBSJ ARIZQ JARIZ QHYMD ULCTK 


5a. Determine the source or method of generation of the following key: 
82490 31675 063593 47325 69227 10571 51498 15286 
18065 37463 98618 01092 ‘74798 11919 11679 20000 

b. Determine the source or method of generation of the following key: 
59326 42580 91806 33386 24182 57468 71540 28908 
06784 13020 19704 22724 31428 53142 84560 37602 


c. Determine the source or method of generation of the following key: 


79246 61605 77639 43926 '72180 93987 22756 49218 
86369 49957 38421 12634 38975 17628 83809 11897 


d. Determine the source or method of generation of the following key: 


43518 20967 29410 15258 54526 82587 41366 55092 
52850 54025 33189 96701 72864 25880 ‘76829 39653 


635 





01531 
40178 
77689 
07276 
A7117 
17230 


KIDUF 
ASNEN 
XIFLD 


57970 
71080 
15450 
14159 


BYJVD 
IVFCZ 
QKYSX 
QWMDZ 


MDULC 
VARIZ 


65379 
27361 


99448 
11162 


31392 
29768 


80576 
16941 


01799 
51347 
T6072 
07310 
37607 
75560 


USLLO 
BSYGN 
EXUBI 


71582 
34248 
68758 
26535 


JVQGH 
DFVRL 
OZDNA 


- MMUAR 


TKBSJ 
QHYPI 


‘67042 


20002 


17346 
A8764 


44215 
16340 


04190 
80490 











hha 
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e. Determine the source or method of generation of the following key: 


93471 49565 94930 51871 29'765 96392 99213 49961 94992 37013 
45361 94330 99457 49943 94994 51875 67389 30338 71219 03585 


jf. Determine the source or method of generation of the following key: 


59438 43712 45956 94412 14613 5OTI9 32522 57484 93703 27465 
44339 57299 09066 25701 91606 32318 25467 91874 39212 27979 


g. Determine the source or method of generation of the following key: 


48057 17417 ‘70473 63098 82865 99303 ‘71229 72305 84242 15552 
59966 37418 90486 83133 03352 25763 61288 62953 ‘70379 62954 


h. Determine the source or method of generation of the following key: 


01360 14961 53576 88234 60570 65276 17932 47206 19267 018357 
14718 01898 19779 06461 80079 80767 87335 08980 87788 54563 


-. 


. Determine the source or method of generation of the following key: 


77364 40908 89071 ‘79788 37225 09475 63860 91469 17084 87822 
56335 19686 16296 '78153 90085 90834 '70844 78281 63319 96408 
62521 87739 06271 68987 60829 68015 33153 64689 25850 '73137 
68792 45616 66090 26992 93972 22694 58983 37716 83522 18743 
24782 61508 59962 48586 41855 59300 31405 45459 07204 79241 


j. Determine the source or method of generation of the following key: 
37259 97499 61385 74132 15453 37259 09749 96385 '74525 45369 
37590 97499 61385 74131 54536 72590 97499 61857 41215 45699 
37259 09799 61385 71321 55369 37290 97499 61387 41321 435699 


6a. Determine the source or method of generation of the following key: 


61901 84775 03315 98714 41689 52248 75012 75379 04305 58005 
30558 00429 53770 12548 ‘72951 84265 88103 35678 00254 56789 
10325 47596 18396 O8101 22436 38404 24456 58504 24446 48302 
22416 07998 17365 57492 11294 76684 02203 85674 92092 ‘74562 


b. Determine the source or method of generation of the following key: 


16202 61340 37100 06781 01056 66149 57520 04962 76405 42033 
96082 62023 21603 21620 57130 08910 81289 27175 81022 965235 
62535 51245. 76973 91019 32602 82450 49196 07816 41121 391535 
12320 09803 11810 44969 26106 14800 59401 64960 24372 04329 
70672 46098 21215 351851 74147 e7d12 43901 055352 92569 58328 
78749 02156 10374 49058 37308 43201 15280 15122 42351 86340 
16146 01396 05125 ‘76011 29477 82020 58703 ‘74690 57392 08333 
91132 94148 23523 31963 35168 44514 '75911 32748 119935 01071 
12117 01880 ‘70327 00050 58707 75021 00436 13035 22032 90294 
25040 52195. 21195 65217 58021 60986 12102 99660 45805 06569 


eo 636 





7. Determine the source or method of generation of the following keys: 


Key “A”: 0360 
9041 
1618 
1034 
6155 
8084 
9906 
6720 
0773 
7992 


Key “B”’: 0178 
1984 
8647 


Key “C”: 4690 


Key “D”: 51747 


206-687 O- 77-4) 


5418 
9518 
8319 
6532 
9784 
2032 
A552 
3413 
8664 
8699 


9820 
1229 
7831 
6241 
3906 
5318 
1599 
7096 
1920 
33547 


8476 
6654 
5789 
2566 
4510 
5335 
6963 
4886 
4425 
1344 


9978 
3593 
9413 
9878 
8212 
6404 
6688 
6076 
1149 
6720 
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2657 
5476 
72035 
9990 
6788 
1419 
1251 
8802 
3279 
984g 


7302 
40358 
5344 
0583 
9676 
6829 
2952 
3129 
7886 
8715 


7129 
5640 
1924 


9819 
3693 
2549 
A269 
2448 
25356 
9676 
5426 
8461 
3136 


‘7505 
9723 
1066 
‘7996 
1896 
0115 
8554 
7051 
4764 
2470 


9486 
6036 
7282 


7166 
4526 
3059 
9578 
6745 
1562 


5435 
7780 
AT86 
1340 
5031 
1790 
T079 
2897 
1967 
5619 


637 


TT56 
2054 
1309 
5176 
6450 
4605 
3423 
0236 
0505 
0764 


1416 


6948 
7294 
0917 
AT02 
2894 
5039 
8167 
A235 
3415 
6225 


5361 
TTAT 
9490 
2165 
3502 
1150 
O7S1 
0264 
0151 
3541 


7821 
4800 
5992 
0230 
9448 
6268 
2285 
3598 
7411 
8907 


1217 
4640 
4585 
4411 
5704 
6716 
5004 
3592 
6575 
SATT 


6742 
8568 
A875 
9655 
7151 
0337 
7692 
6883 
7248 
84350 


1302 
1068 
1855 
3995 
8341 
3587 
5832 
1113 
6238 
9510 


5808 
9294 
8817 
6212 
9964 
2589 
A597 
3065 
8905 
8373 


5960 
TTAS 
0225 
9799 
8074 
1948 
5625 
0481 
7023 
A781 


0202 
2762 
6553 
9494 
9040 
1881 
3139 
5719 
6932 
7514 


9790 
6030 
73520 
8140 
TAZA 
4623 
3491 
9257 
6582 
1735 


2212 
T3578 
5105 
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8. Determine the source or method of generation of the following keys: 


Key “A”: 


Key “B”: 


Key ‘C”: 


Key “D”: 


0812 
5311 
2629 
1924 
1654 
3673 
0405 
1844 
8989 
1285 


3787 
AT41 
9954 
0528 
2941 
5998 
6317 
6886 
5946 
5482 


2009 
5522 
8963 
S776 
8657 
5028 
1400 
13506 
6554 
1794 


1594 
5565 
9290 
2601 
4909 
3474 
4360 
0740 
6586 
9042 


6092 
1618 
6521 
A243 
5289 
5257 
3916 
0409 
6508 
1558 


2422 
3066 
8723 
6052 
2358 
6699 
6377 
O507 
9543 
6628 


7085 
3430 
T3739 
4620 
1388 
9265 
2477 
7082 
3319 
4770 


5519 
7475 
5188 
9710 
0351 
1846 
1867 
6461 
3269 
8295 
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9531 
1943 
ALT71 
1755 
1861 
3574 
1602 
6643 
7091 
2160 


8189 
0730 
8327 
3704 
2524 
4268 
5944 
2626 
0184 
6135 


2534 
L749 
3801 
5485 
2887 
4512 
59735 
5246 
3820 
4446 


6LTT 
A252 
7932 
T7731 
7054 
6803 
S737 
0853 
2871 
9580 


2226 
9084 
4591 
3259 
9112 
0572 
2580 
5139 
4031 
63563 


2952 
3809 
4399 
2876 
8891 
4326 
7832 
8841 
6745 
8558 


0907 
8358 
8095 
2359 
QLTA 


8618 


8517 


6032" 


9A96 
4494 


5152 
4546 
9886 
4201 
0202 
4656 
TO1LT 
4199 
6083 
5848 


8481 
4527 
6203 
7617 
9156 
2430 
9311 
7001 
9312 
2449 


6960 
9431 
6284 
2889 
9172 
3426 
2200 
2415 
4950 
7240 


1764 
1142 
5901 
8984 
4639 
T7652 
1408 
9323 
5845 
3625 


8388 
4231 
2628 
0965 
ATAO 
5200 
5062 
7142 


6358 © 


0848 


9995 
5981 
7992 
8296 
4452 
0074 
8562 
1963 
A957 
3473 


3105 
4675 
9018 
2599 
3799 
8668 
3594 
8985 
5355 
6746 


1666 
6236 
7976 
3078 
2454 
1850 
7033 
0353 
6022 
9545 


1681 
0624 
T1T72 
53581 
5667 
5282 
0425 
2297 
6703 
S731 


4063 
5985 
6538 
7119 
6425 
1682 
AAT6 
1121 
1657 
LTAl 


2815 
2401 
2585 
5486 
97°70 
6797 
9332 
4660 
6423 
3929 


1962 
3539 
1616 
7133 
9946 
2083 
1863 
1252 
4146 
9771 


0658 
3377 
1046 
4813 
8543 
8911 
7839 
3651 
5396 
5971 


4408 


6270 
2901 
3145 
0033 
4436 
7311 
3015 
ST4l 
8005 
TT3T 


4589 
9501 
7202 
1652 
6783 
8626 
0861 
9181 
8512 
4464 


3713 
1431 
4241 
9499 
6004 
7320 
9894 
8574 
2092 
9612 


3124 
3540 
O777 
A972 
6907 
6918 
35032 
9269 
6594 
4110 


4094 
7826 
8384 
2726 
9350 
6116 
8953 
0243 
7362 
T7015 


8513 
3913 
9223 
1187 
6957 
2240 
9720 
5589 
6002 
1533 


6750 
S225 
9270 
5699 
5023 
2480 
9248. 
9216 
2024 
1501 


0736 
1987 
6875 
3483 
6847. 
8607 
1425 
OTO9 
5024 
8651 





RR ot 


ar 


tee 


Whew 


Key “E”: 8668 
6746 
2399 
A675 
3105 
3594 
5355 
8985 
3799 
9018 


Key “F’: 2009 
1594 
7085 
5519 
2054 
6177 
0907 
5152 
1764 
8388 


Key “G’: 1666 
1681 
1962 
0658 
5290 
2593 
3713 
3124 
6750 
0736 
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2240 43526 
1533 8558 
1187 2876 
3913 3809 
8513 2952 
9720 ‘T8352 
6002 6745 
5589 8841 
6957 8891 
9223 4399 


3430 3801 
T7457 ‘1932 
1749 8095 
A252 9886 
8358 5901 
4546 2628 
1142 ‘79°76 
42351 T1T2 
6236 1616 
0624 1046 


5539 8898 
S377 1912 
9774 4241 
8066 O77 


3225 8963 
1987 9290 
5522 ‘TOTO 
5363 5188 


6699 
6628 
6052 
3066 
2422 
6377 
9545 
0507 
2358 
8723 


2359 
4201 
8984 
0965 
5078 
53581 
7133 
A815 
2851 
4762 


9499 
A9T2 
5699 
3483 
5776 
2601 
4620 
9710 
5485 
T7351 


5998 
5482 
0528 
ATA 
3787 
6317 
5946 
6886 
2941 
9954 


4639 
4740 
2454 
5667 
9946 
85435 
5920 
2605 
6004 
6907 


50235 
6847 
8657 
4909 


6797 
3929 
5486 
2401 
2815 
9352 
6425 
4660 
9770 
2385 


1850 
5282 
2083 
8911 
L157 
0801 
7320 
6918 
2480 
8607 


5028 
5474 
9265 


8626 5757 3426 
4464 ‘7516 ‘7240 
1652 4892 2889 
9501 8297 9431 
4589 ‘7233 6960 
0861 2073 2200 
8512 4165 4950 
9181 8821 2415 
6783 2173 9172 
7202 6632 6284 


1863 8396 2092 


7839 2948 6594 8651 
0804 8574 2024 1794 
3493 9269 5024 9042 
9894 9216 6554 4770 
5032 6010 6586 8295 


9248 13506 3319 
1425 0740 3269 
1400 ‘7082 3820 
4360 6461 2871 


2477 5246 9496 3625 
1867 0853 6083 0848 


39735 6052 5845 
3737 4199 6358 


9. Determine the source or method of generation of the following keys: 


10097 13586 80959 
67071 65886 ‘79997 


97325 86346 59091 
71538 86767 9'7080 
48679 77602 16569 


13586 80959 ‘74945 
58867 36276 ‘76403 
34030 69268 48187 


48056 
56147 


56489 
AT640 
74818 


48052 
98951 
24718 


Key cca? 


96248 40372 42268 96450 


25665 


Key “BR” 


48052 ‘72063 68953 50930 
65398 65747 50366 13398 
332135 04890 84682 ‘753505 


Key “Gy 


36104 08229 30323 25601 
T1217 ‘76850 658135 ~291'70 


70489 


639 


20902 


02560 
54557 
78558 


76435 
535034 


90190 


90252 
53034 
28260 


07153 
99074 
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Key “pty 


33765 73548 17392 47429 40372 61040 19645 32320 15953 90937 
S1131 43970. 15736 32366 95116 17340 97361 85111 18240 26148 
90743 02051 26866 '73053 50532 55357 87098 52964 08342 93520 


Key Om 


46735 80959. 92927 29624 O6361 29166 09025 33476 80336 53831 
16588 '70443. 36147 98951 '76833 669735 65813 11992 40635 67990 
30973 65748 38524 23885 89055 54828 98349 64778 60955 88455 


Key cop 


35863 54876 91173 89474 40372 20082 03232 01595 64350 67071 
31131 67439 80157 36653 12171 68503 36170 98851 57182 26148 
92340 92686 87305 47186 54704 55357 82870 03529 34282 ..35273 


Key “Gg 


08422 09303. 15953 25290 15383 11658 80799 O1573 03236 60657 
27685 '70658 01080 82406 34261 85269 65692 73055 21350 48905 
75482 ‘79645 

Key ‘ay 


53376 67354. 11739 94742 24037 36104 31964 03232 01595 29093 
831135 ‘T4397 01573 03236 89511 71734 697356 88511 


Key “1” 
72768 ‘70658. 99291 63530 67990 92340 65692 57481 85247 54704 
54828 34912 77835 82609 34435 20135 '76809 92749 62480 06361 
20082 09303 90256 34764 67071 16588 44362 14764 53989 87712 
T2768 

Key “J” 

40323 98951 21717 85036 58133 92917 03426 90743 03097 26866 
81873 71862 47048 28468 25624 58083 60935 52738 58634 09590 
27494 05240 61040 22916 32320 56015 43508 70715 


Key OK 
65201 48768 92927 29624 '72063 40200 45093 20902 53347 37670 
31165 70443 36147 66539 16877 40727 61706 11992 40635 48679 
Key oy? 


89531 09303 25601 01902 07153 58867 ‘70801 76403 53989 57471 
O7276 T3617 31060 82406 


10. The following key was recovered from a depth of two in a Hagelin C-38 machine cipher crypto- 
system. Reconstruct the pin and lug settings. 


5 10 15 20 25 


116 7 21912101915 6 01719 2112 723 921 7 22 1418 24 11 
1 7 615 81212 2 51510 719 20 23 18 2419 24 20 9 1 20 25 24 
119191611 21 251820 111 6 3 724 621 910 5 8 1 525 8 
211521 723 710 618 02019 4 20 24 21 6 2311 6 22 4151312 


eee 640 
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I. Teleprinter key analysis 
(Embracing Chapter X) 


la. A certain cipher teleprinter has four wheels with the following patterns and rules of motion: 


1.2 3 4 5 6 7 8 9 
Wheel A: x x 0 0 O X X X O, moves one step at each operation 
Wheel B: o x X xX 0 O X X_, moves when A is “x”? (CCM motion) | 
Wheel C: x0 0x0xO0 , moves when B is “‘o”’. 
Wheel D: 0 x 0 x o , moves when A+C is “x” (xx, 00=x) 


The following wheel combinations are used for the five key levels: 


KL1: A+B, Vernam (Xx, 00=x) 
KL2: A+C, W WT mW 1 tT 
KL8: B+C+D, " W 1 " uw 
KL4: B+D, mod 2 (xx, 000) 
KL5: A+D, Boolean (xx, xo, oX=x) 


With the wheels aligned at their initial positions as shown above, complete the diagram below and 
decipher the remainder of the cipher text: 


5 10 15 20 25 30 

A: xx¥oooxXKxXKOXxXOOOXKXKXOXXOOOXKXXKOXXO 
B: oxxXxXxxXxXOOOxXXKXXOXXXX 
C: x00000000K000000KXKXXKX 
D: oxxoxooo000 xxoxooo0oo0oox 

5 10 15 20 25 30 
KL1: ox000xxXOXOXOOOXKXOXOXxX 
KL2: xoxxxoooxxoxxxoO0OoOxoxx 
KL3: xooxoxxXxO0O0OxXO0O0XxXO0XO0O000X 
KL4: oooxoxxo0o00o00o000 xO0OxOXXXKO 

KL5: x X X Oo X X X XO xX xX xXOxXxX xX xXOxXX = 
K: PZLCOCLXXTAPZLCLXT535Q 

Cc: SPVYZGMDTWRSZDRLSTUMNSUGMUSKCI3 
P: NOWOMOVINGSSOUTHITOSD 


b. The following bit stream is the result of a Vernam or mod-2 combination of two cyclically stepping 
wheels, one of which is of size 11, 12, or 138. Recover the pin patterns of the two wheels. 


5 10 15 20 25 30 35 
XxXoOoox oO XxX OXOQOXXK XOX xXOOX0O0XO0O0OxXO00000X0xXK 0K 
40 45 50 55 60 65 70 
OX XXXXKXKKXKFOCGCOIOOdOIdOCGe0O000S0R xX Ox O xX xXOXXxXO0O0O0O0K 


c. The following bit stream is the result of a Boolean combination of two cyclically stepping 
wheels, one of which is of size 11, 12, or 18. Recover the pin patterns of the two wheels. 


5 10 15 20 25 30 35 
XXOXXXXKXKXXXXXKOXKXOXOOX XOX xX XOXKxXXXOXKXKOX 
40 45 50 55 60 65 70 


XXXKXKKXXKXXOKXROOCKXOKKKXXOKOCKKKKKXKXKKEK 


641 - whi 
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d. The following bit stream is the result of the dilation of a slave wheel by a cyclically stepping 
master wheel not involved in the key, the master wheel being of size 11, 12 or 18. Recover the pin patterns 
of the two wheels. 


5 10 15 20 25 30 35 
XooooO XxX xXXXxXxXXK¥XKOOOXXKXKxXOXK XX xXOOQQOO0O008Kk 
40 45 50 55 60 65 70 


xXx x OOO 000 0X XxXXxX* xX xXO0OO0O0 00X00 XK XxXxX00000 


e. The following bit stream is the result of the Vernam or mod-2 sum of a cyclically stepping 
master wheel and its driven slave wheel, the master wheel being of size 11, 12, or 13. Recover the pin 
patterns of the two wheels. 


5 10 15 20 25 30 35 
Ox x xoxox xoxo0oo0oxo0o0o0 xo000c0 0 XO0OXKxXxXOO0O0XKxXO0O00 
40 45 50 55 60 65 70 


xoooox xxoox oo xxx xxoxxoxox xoxooox x xo 


f. The following bit stream is the result of the Boolean sum of a cyclically stepping master wheel 
and its driven slave wheel, the master wheel being of size 11, 12, or 13. Recover the pin patterns of the 
wheels. 


5 10 15 20 25 30 35 
XxX xXxXxOOXKXxXKOOXX XxXOOXKX XXX XOXXXKXXOXKXXXX 
40 45 50 55 60 65 70 


KX XXXxXXxXOOXOXKxXOOXX XX XKxXKOXKXXXxXOXOOX XXX 


g. The following is key produced by a simple 2-wheel machine. Recover the pin patterns of the 
wheels, and determine the derivation of key for each of the five key levels. 


5 10 15 20 25 30 35 
8BDMQES8EMERSOOS4CTQWCFDQSCSOSRTDOC4S8 
XXOXXXxXOxO0xXxO00x000XKxO0xXxXxXXOXxXO0OXO0O0xXO000xX 
xOoOoOxOXxXOOXO0OO0OOXXKXOXXxXOO0O0XOXxO00XO000XxXX 
XOXxXOXKXxXO0OX0000XO0XOXXOXXKXXO0O0KO0000xXOX 
xxXXOOXXxXKOXOXXKxXOxXO0O0OOXKXXOOXXxXOXOXX XOX 
xXOXXOXXxXOOOXXKxO0OXKXXxXO000X00XX00XO0xX0O0Xx 
2. From. the following key, recover all elements of the cipher teleprinter involved. 

5 40 15 20 25 30 35 40 
SOHAMILLACOSBFZWSXRTOGZOAPSBNSALSSB8ZCZSV7ES5SILK 
xooxo0000x00xxxxxxo000xo0x00xoxxxoxxo0oxxX0O0x 
oooxOoOxxXKXXXOXOOXKXOXO0OXXXOOXKXOXOXOOXOOXXKXX 
xOxOxxO000xKXxOxO00xx00XOXxXxXO000XKXKOXOXXOO0O0xXOxX 
oxooxo000o0xoxxo0oxxxo000o0xxxo000xo0xo00xo00xo0o0x 
oxxoxoxxoo0oxoxxxxo0000xx000x0oxxoxoxooxoxoa 
45 50 55 60 85 70 75 80 
S8GMETITGIHYBV7VTRSYBUEJHOTZVZCCU4SBKOEQ4MSBDT4 
KKXOOKO000XO0O0XKKXKXxXO000KOKOOKOKKXOXKKOOKXKOO 
oxxooxxx000x000x0x0000xKO0XXxXxXxO0x00Kx0x00X 
xxOxOoxOxXxXOO0OxXXOx00xXXO0O0XO0XXXOO0O0OxXxXOXOXxOO00 
oxxxo0ox00xXO0X00xX00X0000K0xXxX00Kxx0000xxx00 
oxxxooxoxxoxoxx000xOxxxx0000xx000XKOXXOXO 

85 90 95 100 105 110 115 120 
QJSMIWN4HGYOS9RYDSSBAQSLPF7TJIP4XHYSETSUOPDFS 
XXxXooxc0O0OO0OOKO0OKXKKKXXxXOO0O0xXO0x00xXO0xXxXxXOXxXOO0OXxXO 
xxooxxo0oxoxo00xo00xxxxOxxooxxxo000x000x0 x000 
xOxXXXOXOXOXKxO000XKxXOXKOOKXKOOXOXXXOOOXXOXKOXxX 
oxoxooxo0o0oxo00xoxxx00x00x0x00x00x0000xX0xxO0O 
xooxoxooxxxo0o0xo0oxxox0OxXxO00O0OXOXXXxXO0000xx000 
=SEOneT= 642 
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3. The following is key from a cipher teleprinter, one of whose wheels is of size 19. Recover all 


elements of the machine. 


15 20 25 30 35 40 
SUSSYTEYOERESMTYOOSUCEPTBO4MCMCESFS8S8YSMGGY 


10 


5 


Ox oO O XOXKXOXOO0OOxXO0O0O0 X0xX00 XK000 000 X0KXKXXXOO0OOX 
OoOx0o00000000000000 KX XO0OX000 KO0OXOKO000XKXXOXKOXKXO 
OX XoxooxxooxoxxxXoxxoxooxoxxxxoox x xxx xKoox 
Xxooxoooo0ocoo XXO0O000XKX 0OX000X00KKXXOXKXXXOXXKXKXO 
o0O0OOxxOxO0O0OO0OXXxXO0O0 000 XKXOOXKOXOO0OO0O0OXXXXKXXKXKX 


75 80 


70 


65 


55 


50 


60 
PWS3WCS8FGPS8SWMGUSY4FFEQOYGCG339J93IJTGMEWPCT 


45 


oOxOxXxOXKXoO0OOKXOOXKOXKOXX xO0OxO0O0O0OO0O0O00 XKXO0O0OXO000XxXKO000 


Xx XOXX XOX XX xXOXxXo0O0CxXO0O0000X X*xXO0O00X 00 X0xX00xX XXO 
xXxOoO OXXxXoOxXxXOxXOXOXOxX xX OX xXOxX0O00X0xX%0000X00X XO 


OOxXOXXxXxXOxXOXKxXOXOOXKxXO0O0OOX XX XKxXOXKOXKXKOXKXKOOQOXO 
XXOxXoOxXoOx xX xXK xX xXxOoO xKOoOOOOOX x0 x0 00000 0X XK xXOXXOX 


ao) 2 


3_9 
000 


X¥ooxooo x00 0 X00XKXKxXXXXXKXXOOOXOXOX XxXxXKOOXKOOX 
OoOoOx x xooo oc O0O X00 00 0 KX KXXKXOXKXXKXOXXOKXKO0C0OKKOKXOXX 
oOoOxox0o0ogo0go0 000 X X00 0 0KX0K KXXOOKOOK XK KKXXXOKOX 
oox Oo xo 0 00 XX 000X000 XKXXXKXOXXKXKXxXXOOXOXXXO0O0OO 


5 


Ox OxXxOXKXxOXo00X 00X00 XK XO00KXKXOKXOO0OKXXXKOXO 


110 


4EMUMEE4ZETTUSS3W44U8PG88FTY8TPBYISBCBMP 


105 


90 


. 4. The following is key from a cipher teleprinter involving a combination of three wheels for each 


key level. Reconstruct all elements of the mac 


e@. 


20 25 30 35 40 
DWRBESJSHSZASKUSXUJUFZIDEDWSMOSYRKITZV7MSUC 


15 


10 


(a a RS PE CE A TY EE SE 


X XOX XX XOOXXXKXKXKXKXKXKKXXKKXXOOOXXOXO0O0O0xXK000X0 


OX XOX xXoooxOXKxXxXoOoOx xX xXo0o0o0x 00 0x00 00 0K KX¥XOO0OO0Q0O0O0Q0XKX 


9o0oO0 Ox 0 XXoOOKX XOX XOX xX0O000000XK0xXxXO0O0xXxXO0O0O0O0XKOXKX 
xXOX xX xXKxXOO XKOOXKOXK XOX OXKOX xX OXOX xX XOOXKxX0000X XOX 
Ox Oo xXoOOoOxoo00 0 0 XX¥O000K0O0O00 0X0 XK XoO0KOO00KXKOXKXKOAOO 


50 55 60 65 70 75 80 
B87 SRFKSGT49LTVGULITLIJIYGNOSLI TRKXE 4 


45 


N9ZY59YWI 


OoOOxxXxX* OX xXoOxK xoxox xX xo0o0O0O0O0O0O0O0C0X x00 0000 X00XK XO 
O00 0 X00KXKxXxXOOXKOXKOXOXOXKOxX OX XOXO0OO0OOQOXKXXOXKOOX 


XxXOxXoxXxXoOxXxXxXOXKOXKX xO0OO0OOXKOOXKX XOX OXO0OO0O0OX XO0OO0OXOO 


xoooxoo000o0o Xx00XXKXOKOOO0OO0OO0OXO0O0KOXKXXxXOOOOXKXOO 


OOoOxxxXOXxXOXxXO0O00000KxX00XXxXKO0OO0OOXKXOXOXOXXOXOO 


115 120 


110 


EBEJS5G5SC7G8IJIVRYZALFLNEFWMXTSENTYEONYRVKS8SBNA 


NR NR RL 


100 105 


95 


xX xXoOoxXx 00 0X XO0OOKX XOX o0O0O0OKXXOXOXKXO0OXKxXO0OOXO0OOXK XOX 


al 


ogqoooo x00K0KXO0K000XKXO0KX 0X80KKO0OXKO0KOXO0O0KKOXKXKX XO 

OxXxxXXXxXOx KK xX xOOOOX*OXOXOxXxXO0O0O0O0xX000XxXOXXK.X¥XXO 

OoOOoOxxXxxXoO0OOKXOXOxX xO Xo0xo0o000 XX xXxO0O0O0XKxXOXOXKOXKOXOO 
643 


OX XXXKXOKKXKXXOOKXOxXOO0OOXKO0OO0Q0Q0000000000X XK XKXOX 


ee ee 





40 


PBKYYQIJ4HHTGTDBXZFZITNSEUTKSMMUASOHIGGN 


OX XxX xX xox oo O0O 0 O0OOX XXX XKxXOOQOQOXxXKxXOXKxXOOxX XxXO0O0XxX0O00 
0 
Z 
x 


_G_ 


8 


0 0 


oOox xO OO XxXO0O0O0 0 00 0 XxX 0X X XOXXO 


_R 
OOoOx0O000 XOX XKXKXXKXOXKXKXXOXOOOOXKXxXOXOXOX 0000900 


5 
2_D 
xX X 


7 
eat 
0° 


x 





x XO 





30 
70 


VHFKS88S3HVCFT7OWWDDYSOITUSIGI 


65 


25 


Key “oA” 
20 
60 


X¥xXxO0OO0OO0O0XK0O0OxXK xX XXXXOO 


15 
55 
x 
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x xX 





Ox XxX xX xXoOxX x xo0o00 0 XX 0000 0X0 XOX XXXO 
XooxkxXox xo0o0o00 0XXo00X 00 X%0XK 000 X 00K XK 


Oo 


x 





10 
0 
x 


50 
E'7 IB 
Xx 00 X 


45 


AAY WW 


5. The following two key streams were recovered by exploiting a “bust” situation. Recover all 
XXXXX 


elements of the cipher teleprinter involved. 


o0o000 000K 


xox oO x XxX xXO0OO0O0OX000 0000 X00 X0X 0X X00 KX X00XKX KX XO 
OOx XK xXoO0O00X 


xox XxX xX xXo0OOxXKxo0oO0OO0OO0OO0O XO XOX OX o0OOxX OX xX XKXXOOXKXOO0OOX 
ox xooo Oo XxO0OO0OO0O0O XO0 XxX xXOxXO0O0OO0OO0O0O XK X00 O0O KX XXOOXO0O0O0X XXX 
Xx XOX xXxXO0OOOX XxX XxXOXKXxXOxXO0O0OO0OO XO0O0O XOX xXxXxOOXKOX OX XO 


xXx XOX xXOOXOXO0OOXX 


120 


= OO} 








0 





UUNDDZDSNEYPJI4 


XXOXxXKxXXKXOXKXOX 


40 
V7L VR 
80 
120 


oe 
84 


0 0 





X XXX XK. 
xOOxO 


o 


MGW 9 


OX xXO0OO0OO0O000K XX 0O- 
oO 


x 


35 
TK 
ox 


fs 


is 
OX 
xX¥OxOoOX OOO XxX O0OOXK XO 


x xXxXxXO0000 
0 


xX X 


30 
70 
110 


ITRIBYOOTOC 





OX XxXK XX 
QO 


Ox xox x xoo00o0o ogo X00 XO0X XOX xXo000 0%0 00 00 0K K0O0X XX 


X XOX XxX xXoo0o0Oo0 OX XOX XOX XK xXOOXXXKXKOXXXOQO0O0O0O0OXXOOXO 
0 





x 


x 
05 
P 


0 


25 
65 


10 


° 


o00x 
644 





20 


60 
YSECOGTEEVRRPVTTSCSZE8ESHT 


100 
E70 RY V 


Key “BR” 
4_0_0.F 
xX 00 X 


M4 Q 
x 


15 
55 


x 





95 
XDDZ 
x 


XXxXOXXXXXKXKXKX 





Ooo OX 00 X0O0XXKXXKXOOKKKOKKOOVCVC0OKOKK KE 
X¥xooo0o 0O 0 00 00 KX 0K XXKXKXKOO000 


XxX XOO0OO0O0 000 000XK XK 


KXXXXXOOKXOOXKXOXOOQOX OXOXKXOX 
o0o0oO0O O0O X00 00 KXXOOKKKXOOXOXXxXO0OO0OK XX XXOXxXXXXO 


10 


a a 


ox xXx ox oo xX xk xoo0oqo0oqo0oo0ox xO XOXKXKOX 


50 
PXQNFNSLHIAB 


CK Q 


9 


5 


MS8BAMSBVCDEBOHHLOYWHUPDIJICXFOBUYYBODE 


85 


KAA4ZDZAS AK 8 


45 


XX XOO0O0O0K XOX xXo0OO0O O00 XxX XK xXoOXO0QO0Q OX Xo0OXK XXOXKXO0O000 0 
oo0o0O 0O 0O F0O0O0O0 XXOOKKKXXOOCKOXKKKEOOVOOKKXEKXKOOKXKXXXO 
XxX OX XxXXXOXK xX 00000000 0K XK xX XKXOXOO0O0OXKXOOXKXOOXX 
KXxXOXXxXOO0O0OO XXX XxXOXXKXOXOOOXKOOXKOXKXXOOXKOXKOXXO 
Ox OX XOXoXxo00 0 XKXoO0OOO0CKXKXxXxOO0O0O0O XK xXO0O0O00 000 00 0X X X00 
XXXOxXxXoOO xKxX OX xXO0O XK xXxOoO O XO X00 0X XxX xXOO0O0O0xXO0OxXO0000 
XX XXKXKXXKXXOKKOOKOKKXXKXOKXOoO0C00KxKO0x0O000CXOXOXK XO 
xXx xXOxX OX xX xX xOoOO0O0O0O0 XxX O0OO0Q0O0Q0 0 0X 0X000XK XXOO0OO 

OoOOxXxooOoOxKXxXOOXK XOX X00 00 XK X00xX 00 X0X 000 X00XK X 


XXXxXOOxXOX 
*¥O0O00000 X% 0 
x¥o0o0o00xX0000 


Xx OO O0O 0O 00 00 0 KX KF XOXOOKO0O0O0XK 00 0 0 KX0 FX 0O0 X00 XX XO O X. 
OoOOX XxX OXOX 


40 
120 





SECRET 
115 


35 
HZMSHZXRGLSADNM 


SSAIJDZS8CSEFO5 





30 
70 


EK X 0 NN 
Oo 


110 





25 


105 





65 
3 Y W009 
xxOOxXxxO 


20 
x oO 


60 
A 
100 


x 





15 

55 
(BOTS 
x 0 O 

95 


Ox 


2A} x 


0 





GL 
0 Oo 


5 
x 


x 





3K 
ox 


_5 
= 


80 


Q 


ox oo X0O0K XOX 
120 


75 


G7VWLOSB3 CYST 


115 


70 
110 


YSXLMCYTOSXLXBU 


oO 





Cc 
° 


S$ 


K 3 
x O 


5 


6 
GM 
x 00 
105 


GW 
° 





3 C 

00xoO 
100 
645 





x 


YX 
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oO 
95 
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R_R 
5 
x 


XX 


10 
50 
90 
x 


1 














oO 





X83 
xX x 





° 


5 


45 
TSOSUILITUS 44 
85 
Oo 


JDWZSBCVKXVCKXDVCS8FG4R4AD 


x 


o0oxoo0o0o0o0o0o 0O0 000 XK XO0O0000 XK XXO0O0O00KXO00XK0 0X0kK 0X0 


7. In the following teleprinter key, KL1 is produced by a combination of a 19-wheel and another 
x 


6. From the following key, recover all elements of the cipher teleprinter involved. 
wheel. Recover all elements of the machine involved. 


H WQ 


0 
XOXxXoOxX OX OX OXxX OX OX XOXOXK OX OX XK XXOXXOXKOXKOO0OX0O 


xXooooxooo xxxoxooo XXXXxXOKXOOOOXKXX XK XKXXOKXKXKX 
Ox xx XxX XXxXxOxXKOOOOO O x0 x0 xxOO0OO0000O0X X0O0XKXXOX 
o0o0o0oO0 0O00 00 0K KX KXOKOXOOKXO00 KXOKXOKXOO0 0COXKXXXO 
xox xoxox xoox xx xxxooxo0o0oo0oo x00 XXO0OO0O OX xXOXKXXXX 
Ox xO xX xXxOoO xXo0O0O0xX00X0 xx xooO0O0OOXxXxXxXO0O000 OX xXOXOX 
ooo OxXXXXOXXKxXXKxO0O0 00X00 XO000X00000 0 XX¥XKXXOOX 
OoO0oOxXXXKXxxoO0O0OO0 00 XO0xX00 X00 xX 0X X0X X00 XxX xXKXXOO 
oxxoo0o0o0O 00000 XK KXOKO0O000 X00 K00XK XXKXXOKXXKXXO 
XXXXXoOOoOKKXKOOKXxXOOXK X00 O00 XK XxXOXO0O0O0O0KxXO000xX X X00 
XOxXKoOxXXXxXKOXXxXOOXK XX OX XK XXKOXOO0O O00 00O0XK XX¥XKxXO0O0O0O 
OO 0 OXXXXKXKXxXKXKXOXK XxX xOoO0OO0OO0O0 00 X XOXO0OXKOXO0OO00000XK X 
XX 0OOxXK XXX XK XKXK KXKXKXKXiKKOKXKOOKOOOXK XOOXKX XOXKOXK XX 
oOoOxxX xoxox x00 XO XOX O0OxXO0O0 00 0K xX XK XKOXXXOXKXXOO0O00OX 
OX oxkKOXKxXXoxX xXo0o0O XOX Xo0O0Q0xX0 00xXK X0000 XX 0X XO0%xX0000 
XoooooxkXK XxX XOXX XOX XxXOXKXXKXXOXKXOXKXXOxXKOXOXKXX 
KXXXXXXXXOOXKXXKXxXXOXOOXKXOOXKXXKXKXKXOXKXXKXKXOKXKXG 


DLGRLSB4RGAEREKMFSMS3YWBUS4ADHTMO 
oO0OO0OxXxXO0OO0OO0OxXKxXKOO0O 


° 


|* 
Lo 


GE 
ox 





BO 
a 
ats 
| 
Bs 

T] 0 

wo 

kal 

HI] oO 


° 


5 


oO 


° 
X¥OxXox ox 00 0X 0X 0xX0xX 0X 0X KXXXOXOXKXOXKXKOXOXOXKOX 


xXxOoO Xoo xO X00 0 0X 0X XO0OXKxXOO0OO0OO XK XO X0O0000 00K xXXKOX 


x 


4 


90 


85 


HLBHXI7PMKXWHWYGSLGYS8TPW 





oO x oo Ox XOX xXoOxXoOxXxOXK XxXOOXOXXK XK XXXOOOX XXXKOXOO 
OOxXXXKxXxXxXxXKxXxXKOXKXXKXKXKOOXKX XXX xXOOOXKOXXXXOOXK XXX 
ooOxOx0O00O0OXKXOXKOXOOXXOOXKXXXXKOOOXOOXXKOXXX 
Ox 00 087 0X 0X0 X30 KX 0K KXKXKOXKXOKKXOXOXKOXOCKOKOKOOK 
xoOxkX XOX XX xXxOXOXKOOQOOX XOX OX XOX OX XKXKxXOOXOXOX 
oOoOx oO xo0O0O0OK*XXo00C0OKKOKOXO0O00CO0OOXKOXKXOOXxXxXOXXO 
XXXXXOOXXOKKKXXKKXKXEKKKKKKKKKKKKKOKOKKKKKXXO 








DO NOT WRITE ON THIS PAGE 


J. Cryptodiagnosis 


(Embracing Chapter XT) 


One of the difficulties in attacking real-life problems in the initial diagnostic stages, especially when 
the volume of data might be insufficient, is that the analyst usually does not know just how much infor- 
mation be can glean from the particular data under study: he may be content with uncovering and 
explaining a phenomenon, or obtaining a partial solution of a technical detail, without realizing perhaps 
that he could have gone on and made further progress, even without additional data. Therefore, in order 
to give the analyst some idea of the amount of information he should be looking for (implymg thereby 
some estimate of the time necessary) in each of the message logs below, there is appended a coding 
indicating the diagnostic aspects in each problem, thus eliminating the wasting of time in searching for 


nonexistent aspects. This coding is the following: 


SPO oOowP 


. Preamble information 
Enciphered discriminanis or indicators 
. Indicator information 
. Distributional phenomena 
Repetitive phenomena 
Other textual characteristics 

. Further manipulation of text 

. Nature of general cryptosystem 
Identity, source, or generation of key 
Plain text recovery 


la. Analyze the following message log: (B) 


PHO 


c. Analyze 


To 

CFB 
CFB 
CFB 
CFB 
CFB 


From 


NWL 
NWL 
NWL 
NWL 


the following message log: 


NR_ 
111 
112 
113 
114 
115 


the following message log: 


NR_ 
719 
720 
Tel 
722 
723 


FDT 
160905 
160947 
161023 
161112 
1611350 


_FDT 
251406 
231415 
251435 
251451 
231510 


FDT 
271224 
271239 
271250 
271318 
271345 


69 


GR 
85 
60 
64 
59 
78 


GR 
61 
58 
oT 
83 
80 


A2 


AS 


A4 


es eee ree 


38114 


58064 


(BC) 


Zi. 
58645 
95167 
A7867 
09806 
64004 





—ee ee ee —_-_ OO 


ee ee Oe 


Zi 
TTTTA 
92933 
44734 
14809 
20754 


ZO 
735021 
35381 
24229 
76928 
82435 





20 
09243 
25082 
59377 
81617 


51262 


26 __ 
16031 
44195 
56738 


56545 
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d. Analyze the following message log: 


To 

VKF 
VKF 
VKF 
VKF 
VKF 


From 
RNZ 
RNZ 
RNZ 
RNZ 
FNZ 


NR_ 
262 
263 
264 
265 
266 


NR 
489 


FDT_ GR 


031812 
031827 
031834 
031856 
031917 


FDT 
180918 
181232 
181550 
181702 
181019 
181046 
181625 
180836 
180850 
180927 


A8 
53 
54 
67 
42 


GR 
69 
60 
71 
57 
87 
74, 
45 
Bl 
73 
42 


(B) 
A2 


AS 


the following message log: 


Al 
LDSQS 
BFMPR 
MCLLR 
UUOOL 
LILQH 
DLNZQ 
BQXCF 
ZVSFO 
XXRFI 
ZINKI 


f. Analyze the following message log: 
To From 


KTL 
KTL 
KTL 
KTL 
KTL 
KTL 
KTL 
KTL 
KTL 
KTL 


NR_ 
431 
A32 
B72 
A26 
576 
425 
A26 
430 
574 
575 


g. Analyze the 


To From 


EFS 
EFS 
EFS 
EFS 
EFS 
EFS 
EFS 
EFS 
EFS 
EPS 


EMW 
RTM 
CBQ 
TOK 
UIO 
VES 
ZQT 
LJN 
ZEK 
VId 


NR_ 
872 
875 
876 
880 
881 
870 
871 
873 
876 
879 


FDT 


141152 
141306 
141239 
150814 
151602 
161108 
161427 
161628 
160915 
161021 


GR _Al__ 


ZTYBZ 
ZUFMB 
QXWPX 
RDUFM 
QTHMK 
PGQHA 
BYDUX 
ITQDQF 
LYPAR 
ERJAP 


following message log: 


FDT 


200'740 
201039 
201057 
201402 
201535 
210916 
211140 
211305 
211326 
211611 


Al 
HPLSC 
GIMWT 
SWBBE 
NRFCO 
HRVTY 
FJIXTA 
ZZTCE 
GIJAJ 
ITHEF 
AHCBJI 


(BCH) 


(®) 


647 


CDAWH 
WIRSA 
GKBCY 
POQRD 
ARQAC 
DMIAJ 
ECECV 
ZQRXF 
FCWRA 


A2 AS 
GDOZE 





LSRPR FWOKL 


OODFY VYIJK 
DATGL 


KACTM ONKIE 


FTGLY 
NZGXU 


NVXAA VJTWY 


NMPQD 


DYBQQ RQNZB 


QKGDL 


AS__ 
YDDRP 
XAYKB 
DARGQ 
PVRNR 
JSDTE 
KUBUG 
ZRBRD 
HIROO 
XZNBS 
MJANN 


AS 
EYRKZ 
DRSOQ 
FUAKO 
KALUL 
DSCQR 
CSDLX 
ECTHE 
DRPSG 
ETKPN 
WGJCX 


A4 
EDXUZ 
XTLGA 
DVLYL 
XHHBJ 
PGTAF 
MLPHY 
RGSRD 
RBUID 
DWGOQ 
MRAUG 


Ad __ 
ccpvc 
HLZIW 
PFHTB 
ROXGJ 
EABLV 
MKDMR 
WIZUB 
UKJYC 
FCNWC 
XQITG 


A5 

KMVYY 
GMHOF 
ARXPR 
KTGCR 
APRMZ 
KRQXU 
NMHAA 
GHRVQ 
BVDVC 
HHIIX 





AS 
JAXCR 
LSTKW 
SXGOC 
UVAVD 
FVQDM 
XEZYK 
BEKJV 
KRIRB 
OJIGQ 
JUWBT 


-A5__ 
BEZTW 
VNOHU 
UANTF 
KVJCC 
NBEQU 
YFBMX 
PVWFG 
SCHMD 
UXQYD 
RPTJH 


Z1 





12019 
26360 
31666 
36062 
28035 


Zl 





ZO 
05166 
19759 
56528 
T3567 
04507 


ZG 





FOZNU BKURD 


VLOJZ 
YIBCZ 


JTGRL 
WELPY 


YPZSA RADMS 


BFJFT 
PVJLT 
ASXFO 
UQLIO 


PZNUG 
FXHRG 
UMIYZ 
EWKAP 


YSKDR WNNVY 
OFNDY NYDAP 


41 __ 
JVXBC 
RGVLT 
GBXRD 
GOVBU 
ICNDK 
NBWZB 
BXSEL 
PLTYQ 
CSDGR 
IXSXKV 


ed 
MVNKL 
BSJGG 
TSZCG 
UFEGP 
UWIOU 
ARFFC 
OWEUN 
VVYPM 
FHIRX 
ACPQA 


20 
BHKFS 
BIRQU 
SLITQ 
TRGJF 
SHTQD 
RUCLT 
DMPYQ 
KEPUY 
NMBEK 
GFVEL 


28 
IZJLX 
VGZTO 
GODIZ 
XBXIJ 
YVBUT 
ZRFMV 
DDGTZ 
PWANE 
DRXRA 
ZVWYE 











he 


DO NOT 


h. Analyze the following message log: 


To 
ARX 
ARX 
HIS 
ARX 
HIS 


From 
NNA 
NNA 
NNA 


NR_ 
490 
192 
963 
670 
688 
014 
460 
576 
652 
103 


FDT 


190600 
190842 
190857 
191015 
191029 
191141 
191306 
191419 
191427 
1914435 


-Al__ 
35701 
91175 
06712 
65000 
10565 
19676 
11188 
45912 
51695 
55004 


1. Analyze the following message log: 


To 
WRP 
MRP 
WRP 
WRP 
WRP 
WRP 


je 


To 
OKH 
OKH 
OKH 
OKH 
OKH 
OKH 
OKH 
OKH 
OKH 
OKH 


From 


JVM 
JVM 
JVM 
JVM 
JVM 
JVM 
JVM 
JVM 
JVM 
JVM 


NR_ 
981 
982 
984 
985 
987 
988 
989 
990 
992 
993 


EDT 
171102 
171305 
171636 
181050 
181312 
181632 
191108 
191315 
191628 
191646 


Al 


61865 
91514 
273562 
4T149 
36556 
38237 
15646 
72845 
55624 
00802 





Analyze the following message log: 


From 


ULO 
ULO 
ULO 
ULO 
ULO 
ULO 
ULO 
ULO 
ULO 
ULO 


NR_ 
A401 
AOL 
401 
AOL 
A01 
AOL 
A401 
AOL 
A401 
AOL 


POEs. 
081014 
091037 
120925 
151142 
180926 
191057 
211123 
231000 
241045 
260956 


Al 
69158 
26219 
92327 
81761 
51047 
88068 
19086 
34199 
51864 
A9079 


WRITE ON THIS PAGE 


(ABC) 


Ag__ 
18339 
29984 
04331 
54336 
67184 
86281 
52192 
44566 
14491 
28665 


(BC) 


Ag 
98903 
28652 
54400 
T4287 
63694 
65375 
42784 
09983 
82762 
37940 


(BC) 


Ag 
62316 
30140 
54798 
90274 
45489 
63327 
97953 
54162 
87898 
16281 


648 


AS __. 
89693 
05187 
93924 
68077 
76969 
49637 
34137 
39458 
48616 
95676 


AS__ 
67654 
63757 
AT306 
67790 
98567 
89641 
99866 
04945 
65748 
59941 


AS 
99237 
37135 
24392 
05858 
06846 
14153 
80188 
T8867 
85741 
52854 


Ad 
14177 
84552 
83705 
33709 
55331 
98047 
13597 
24211 
30993 
07962 


Ad 
08586 
33763 
71988 
08626 
39495 
51714 
30706 
19874 
58104 
90885 


Ad _ 
72652 
13567 
O7724 
73601 
89287 
46760 
70390 
37513 
68194 
35200 


~AS__ 
01595 
TO9T1 
78125 
27120 
A8753 
80460 
94921 
44705 
59488 
25458 


AS 


17697 
04680 
88231 
86697 
30217 
20570 
45630 
45886 
06681 
55406 


AS 
16948 
45329 
12517 
92063 
39931 
16223 
01628 
64982 
07164 
86754 


21 
80756 
50152 
59586 
09381 
21914 
64621 
89182 
90967 
06640 
73610 


Z1 


99036 
52696 
68901 
96885 
52313 
75995 
28788 
396356 
39112 
32701 


Zi . 


55420 
66206 
25401 
21758 
57570 
28055 
59073 
74186 
90691 
17363 


16855 
04144 
25988 
24045 
84831 
01473 
51010 
T3869 
41589 
AT645 


20 
235755 
93443 
96814 
22501 
25292 
53878 
31962 
90706 
25261 
51989 


ZO 
09145 
59210 
52514 
94943 
91034 
22972 
57295 
16421 
91851 
89066 
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k. Analyze the following message log: 


To From NR_ _FDT GR _Al 
FLC BUG 317 020900 49 89108 
SLY BUG 892 020917 48 23062 
ZBJ BUG 724 021021 62 64527 
ZBJ BUG 725 021037 59 87118 
BUG FLC 027 021013 60 20276 
ZBJ FLC 946 021145 58 '75087 
BUG SLY 375 020941 75 37157 
BUG ZBJ 421 021052 43 25073 
FLO ZBJ 803 021108 67 65729 
SLY ZBJ 514 021121 81 31534 


t, Analyze the following message log: 


To From NR_ _FDT GR _AlL 

DOM KLS 501 130816 63 86284 
DOM KLS 502 131139 48 59911 
DOM KLS 504 131406 46 02889 
DOM KLS $6501 141000 52 39080 
DOM KLS 502 141027 51 13198 
DOM KLS 501 150902 60 78513 
DOM KLS 503 151345 58 11539 
DOM KLS 502 161125 49 40554 
DOM KLS 503 161152 62 ‘76068 
DOM KLS 505 161308 54 20098 





m. Analyze the following message log: 


To From NR_ _FDT GR _Al 
WKN JNT ‘704 101402 58 53044 
WKN JNT ‘705 101421 ‘72 49984 
WKN JNT '706 101450 63 80772 
WKN JNT 707 101505 65 18134 
WKN JNT ‘708 101532 84 ‘T3966 
WKN JNT '709 101555 60 39910 
WKN JNT ‘710 101619 73 31066 
WKN JNT 712 101647 81 51120 
WKN JNT 715 101723 55 87978 
WKN JNT 719 101830 47 29770 


(BDFGHIJ) 


Az - _AS__ 
27704 66181 
60022 ‘74850 
14424 459352 
AT047 81605 
60309 41766 
27705 ‘70442 
02828 64004 
50541 ‘70382 
02826 83500 
02822 73910 


(BFGHIJ) 


-AB LAZ 
89703 98576 
11594 16667 
54220 06677 
48214 88104 
42412 25116 
87031 46483 
67932 88399 
84220 '73220 
34450 80745 
42604 91590 


(BDEFH) 


Az _AS__ 
50667 62274 
T2827 69484 
32975 21872 
90656 235444 
40205 05796 
36522 20270 
243525 853506 
98139 83690 
A627T2 88758 
28725 234350 


Ad 
03417 
16163 
043592 
35392 
15086 
21153 
91086 
25401 
78244 
36125 


Ad 
O7737 
99528 
37543 
42145 
01346 
35751 
97555 
73133 
35618 
03999 


Ad 
96641 
48865 
44544 
34820 
82983 
‘70988 
220435 
89249 
T3924 
66944 











AS__ 
227AD 
48145 
42625 
14046 
35338 
52511 
27705 
00302 
14450 
01615 


—AS__ 
93244 
02606 
22556 
85639 
22642 
66336 
65640 
86796 
AT62T 
49087 


A5 
98885 
58234 
55012 
39266 
69404 
42494 
85015 
51096 
69614 
15032 


41 
11635 
53539 
93094 
11655 
50763 
02524 
61634 
52500 
94276 
64011 


21 
61746 
36289 
95153 
39712 
85453 
01998 
62505 
99002 
38807 
54236 


Te 
TAQAA 
13460 
68041 
64489 
22854 
56460 
14532 
58642 
14128 
95690 


-20__ 
33769 
27123 
18483 
01878 
2AT34 
096435 
81712 
39334 
491835 
15392 


26 __ 
25577 
96768 
40600 
TI416 
59870 
13004 
51464 
8353546 
18402 
69572 


28 
62773 
60282 
82906 
13489 
19425 
64431 
02581 
40243 
38066 
64190 
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n. Analyze the following message log: (BDFHIJ) 


To From NR  _FDT GR Al a2 AS Ad AB Zl 
ESW PTB 336 010930 59 BFCUB QPDFI OJFRV GEFCB XWDAK DHSEK DDGTK 
ESW PTB 337 010956 62 NPYRS DMWVY DETHD IBRFD BHINH RGOGP PAUWH 
ESW PTB $38 011010 63 FAGQT SERVT LKFBU DCPQY NAFZD ABCNH HSGHD 
ESW PTB 339 011036 58 GCARQ OLCQF UNTRD JIKTQ MQVYK QHQCO IZUKK 
ESW PTB 340 011055 60 OKXKJ ZNYBC IPNGR GWDFY OVHSF NTIQR QBOWF 
ESW PTB 342 011130 71 NERJH TYVBM DHAFQ ADPRQ VWHQU AJKHD PMBIU 
ESW PTB 343 011216 '76 GHOQR YXCSF YNWCN OQFBT VUWTD UDPBT ILXSD 
ESW PTB 344 011242 54 YNCSR DRIQH STOJW PNOQZ AGRJT JUWTD AFPHT 
ESW PTB 347 011350 82 QCGMY YBPRS GUFBK VEFRN QTORG FOGBH SPGIG 
ESW PTB 348 011607 73 SZFSE FNIXP WALRB UPBCD RDJRA NPDIC UBMTA 


0. Analyze the following message log: (BCDFHIJ) 
Lo From NR DT. GR _Al A2 AS A4 A5 Zi Z 


IXN YBB 936 051032 67 XGLFZ MVJNS ERKXU BHFUX ODMRX | AVGJR 18965 
IXN YBB 9359 O51517 82 AHMEA GNJNN AYGDL XJXDO PDVGI | RVHLO ‘75421 
JFH YBB 272 050820 49 AMMLA LSGKS ACENM HACMW UNDNA | YOJJP 98265 
JFH YBB 273 050835 58 WIOTA NQFHG QAXNE AUHHM NDUKN | RXGIV 46328 
JFH YBB 274 051141 52 YKNIZ HREGN FREVB PEZTB JLAVS {| UTCOS 58742 
PWC YBB 708 050856 79 RHIEX HTFKH XDAWI LQSJX GOUDO | VXFOO 04597 
PWC YBB 710 051539 80 SHFJU IQHMV BZOTR AFZBJ ZRVVT | UVHNQ 76150 
XGD YBB 564 050925 63 YLLIX IQCEP HUAGY ASHZL YHUSF | WPHJR 87429 
XGD YBB 565 051017 75 WNNMR IUIMC PXYNF WASLB TDJKS | UTFJT 49683 
XGD YBB 566 051445 56 WIFHS NRFIM HZZEJ ERVTE IWAEC | YRBMV 25851 








p. Analyze the following message log: (BFHIJ) 


To From NR. _FDT GR Al _A2 AS _A4 A5 Z1 ZO 

YWR TFE 439 220752 56 62711 26977 42197 32966 09424 | 23634 14492 
YWR TFE 440 220812 59 16887 75144 78023 12322 68913 | 32481 74368 
YWR TFE 441 220827 60 37128 82143 54217 21876 62125 | 16463 ‘73569 
YWR TFE 442 220855 55 81022 06272 63327 94223 70649 | 28321 86693 
YWR TFE 443 221024 57 09999 10261 16332 39077 48187 | 18726 51680 
YWR TFE 445 221107 68 67498 93465 73427 71972 99223 | 44773 03789 
YWR TFE 446 221241 73 33522 56732 19211 72518 44228 | 71063 54553 
YWR TFE 447 221305 51 66387 77578 88244 61620 37148 | 99778 43598 
YWR TFE 450 221428 79 21280 11837 82264 47612 73982 | 87668 89551 
YWR TFE 451 221443 70 35532 17201 O4767 16776 27492 | 61721 38023 

















q. Analyze the following message log: (BHIJ) 


To From NR _FDT GR _Al_ _A2_ _A3__. _Ad AS i _22__ 
HUE AZI 124 300955 48 PMCVC XULRR MFPLN SNOIF KJHUU 59721 95723 
HUE AZI 125 301026 73 ZFZPG TGTVM WYMVO NMLBU MESOY | 84856 37365 
HUE AZI 126 301324 56 MBEGU AVVMO JUXAO IXQSU ILLFM | 33577 22088 
HUE AZI 128 301502 52 JZOJN VMMNV GSIHE VVAVH ASIIF | 40890 71321 
HUE AZI 129 301525 85 WPGDX CBVIS TIUWN SOSZN ZFMCP | 57115 20664 
HUE AZI 130 301548 69 YUWNI. KOLHL VNXGJ TTIGQ EULMA | 97903 91985 
HUE AZI 131 301617 '78 JZOHP ZIGLV GSKFE VXATH SUGGH | 44016 11549 
HUE AZI 132 301730 71 PZMTN EDMIQ MSTUH XIYEN IPRSF | 31919 02424 
HUE AZI 133 301803 67 UBQIX EEOJL RUIVD HUCWL WJRHP | 75925 13963 
HUE AZI 136 301842 58 BUVVX VGTVP YNXQR OBHPV SVSUP | 77583 33527 


ahha 650 
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DO NOT WRITE ON THIS PAGE 


r. Analyze the following message log: (BFGHIJ) 


To From NR. _FDT GR _AL A2 AZ A4 A5 Zl ZG 

_ GSM MNS 847 O70712 98 37777 '70995 39344 99967 86507 | 05503 59983 

: GSM MNS 848 070806 87 86348 99941 00594 99901 02009 | 57780 89582 
GSM MNS 849 070831 99 26998 46760 11696 02921 89997 | 68770 90684 
GSM MNS 850 O70916 93 55766 94356 66959 85899 97792 | 49580 45947 
GSM MNS 851 071014 82 81859 79121 11987 '73199 93108 | 77400 60847 
GSM MNS 852 071052 95 90839 91030 03997 99932 44689 | 55705 '70028 
GSM MNS 853 O71107 88 56675 94003 35888 41664 79995 | 78029 35663 
GSM MNS 854 071328 86 46776 82272 01472 10195 89991 | 21108 61260 
GSM MNS 855 071545 90 17958 86380 21188 07499 90987 | 81120 00176 
GSM MNS 856 O71619 91 54896 67788 03737 99932 53002 | 67093 33884 





s. Analyze the following message log: (BCGHIJ) 


To From NR. _FDT GR Al AQ ASA AS vA 20 

SHF CVG 501 150756 83 AVUXB OPRVJ NIFTH MWQPD DOUSN | 59326 19072 
SHF CVG 502 150835 90 UHIPC PGVXX NTZUM BBJVT CNFUC | 27758 87583 
SHF CVG 503 150941 48 VMMRL NBMYN KBBOL TCGHC XKAGG | 61083 21924 
SHF CVG 504 151037 62 PQHCZ BXUHV XOKQP SCXSQ SJJRK | 15746 ‘76773 
SHF CVG 505 151052 56 WTIJP HUXAV WJTOV UJMES BIFRW | 32188 93130 
SHF CVG 506 151126 59 UJWBX WZQKI VHUIR IQIUA ZUDGL | 94392 55418 
SHF CVG 507 151153 78 YZXSB UJXHW HGNPO AMPRH KCELC | 57911 18064 
SHF CVG 508 151210 85 ANPEV KKZFJ JQQFI DEQJS BURJG | 80647 41857 
SHF CVG 509 151421 73 VOEJW SYMSI TLIOP FSHLZ DWZZW | 03469 64880 
SHF CVG 510 151650 69 WJVHV FBMBL KPDMP TQFHN FVSDS | 47530 08180 








t. Analyze the following message log: (BDHIJ) 
To From NR _FDT GR _Al A2 A3 A4 A5 Zi ZG 


OJP ZKM 251 040810 62 QMUYE RCBDX MNSFW GBTXA IXROY | YWVPE NFGFW 
OJP ZKM 252 040846 88 YVGHK LAXDY NACXF UMNAE PGBWQ | LTREX ITJKQ 
OJP ZKM 255 040915 74 CXIDT WUFHB SRGJB CMLQQ NJANC | AAAAE PKSQT 
OJP ZKM 254. 040942 86 UNUHX TKZTO MKULO WUESA NXGZC | RIBHW TNQZS 
OJP ZKM 255 041005 99 PMGRV LBOQE NZXGG OTWKR TRAZC PJRMD QKMGU 
OJP ZKM 256 041028 60 LWRUM BVYVL WNSQB KIMUJ WEAHS | VLJUG IPDBE 
OJP ZKM 257 041052. 98 GTLSE MTBDU WRSFZ OTKGQ VCBMX | AJQDX JMNKM 
OJP ZKM 259 041121 89 JMJXA SIFEE NYXSN GKAHM AGHIM | JHQHO DDMOE 
OJP ZKM 260 041143 65 KHUHZ YPLQI LQUEA JYNYT PXFSN | MZIWO MQRZF 
OJP ZKM 262 041200 87 EMRUM LPOUT SQYPA GZJQL WOZMR | SAAAP IIABL 





2. Diagnose the following, reconstruct all elements of the cryptosystem, and recover the plain text: 


ZUBBK AZUJM OMVZO NDUPX XCNQZ OKAET WRGUX BGVUZ UPEVC XLAZO 
MQVPO IFIKE TKAIZ OJRRW KAPBV ZUPQE NSEPL KILKI HVOBJ KEBIZ 
.OJLCZ UFKEB NKIBK ALGJT XGAIR- TAFNV KAYJU GJRYB ESBNZ UZYEG 
KAGKI LYGXH PPDYZ YQZUJ IZOQA DHBGH KESBI LMRGR WKEHR ZOJDK 
ITKIZ UKEKA CZURC KEMXB IKAKE IXZOW FPGXM LMJVK EMOQI ISKEG 
DPZYM BWBKA CGZUS JHWZO JPOYF OJTQO OKAPA DCXTE VUVNX VXZUY 
1 TZOXL LTOOU ONJJS KITKE UDXKA VKIJJ 
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3. Diagnose the following, reconstruct all elements of the cryptosystem, and recover the plain text: 


AAUMQ AGNYD HOFXV ETMQH SLDON EXOWQ RVHAW KAMNX NPCGQ DLMPS 
XAIUB QDWXU PLDED OJIAR OQEEP MOXMY LHQGU GDCXF HHZQE CVEMX 
BVVEQ ORWDX TMWPW HQMLM WXRAR OMDIF GQEEP MOBWX ULWUS EWOQP 
CXFIH PMNRW LQOYD KZSOX MOLBO QSPEI ORPUH XERTF HAIUB QDWXJ 
TPEID KSAVQ VVAOX NDRWA AHUQH IGTXD LQBFY GOXFJ AYHGU QWPXZ 
ERQLG WDKXN PNAOM FQHIX TUPES MWCKH QJLZX EEPMO QMYLH 


i ily 4 | bs 


4. Diagnose the following, reconstruct all elements of the cryptosystem, and recover the plain text: 


BSZXG YMPSX QAHOL YCDSF IQAWQ MYMEX BRRWN ZPWWC KQAHF OBYCW 
LTYVO QXMEZ PPCGN ZTJBR YYLER JTDQW AOYUZ EDFSZ DBUKD FFQLZ 
IBDZB MLCJH QKJHI KOWTG KLASG LRKUY KNJCP HRBIX QUAOC NELLY 
HNAPH IISYP DNJKR MVBHJ QVFXG TVLLQ HTJQQ WESUY BQOLE GNCUP 
WIWXH QEIJD ZSUQS DWZVW TRODL IVZAP RVREH PZZWC MQWBT GDXTF 
TLEIM OAAGN ZDSRL XXUVP WZPNS TTREI YGLQP RELZV BTPIV NXHUN 
PLNYE ISUWD XWGPV IRCKP JCSRJ VVSMI UVNOG UEABV CRRJF YSFIO 
YFDMK SGEQJ LHJUD JCMQM BVLSS FIVXH JDZLE RJTDK ZSWCQ EPGNN - 


5. Diagnose the following, reconstruct all elements of the cryptosystem, and recover the plain text: 


CFLOL ACABJ GGCFD DCGAB ACOJA DOACG ACAHN OEACA GMOTA CLLFI 
JLNOG JLIEA CCDIO JADOH LACAC GALFA GAGAC ODEJB DOABC AHJAK 
ADAGC HACMO CLIFA GAGAC LNOAT JDFIF JGDOK ACFGH OAILA CAICL ie 
ACMOF GOKAG CABAF OADJL ACDIO DIJAI OABCD EFGHO ABJAG OFGAD 





6. Diagnose the following cryptogram, suspected of dealing with agent activity in Greece, and ~ 
recover as much plain text as possible: 


ANLSL GSGLN SYSLD LSAUS ALASG SLLPS AOSYG LSLSN SYGSL ULSAA 
SLLGS ASLSL SYRYS YDSLY LSYSD PSOSA PRSLG SADUS YYSYO USLNS 
YGLSL SLAYS YOSLY USAYS GLNSY SLLNS ADSDP SOSAD USYYS YRYSY 
DSOPS LASLG USLNS YOLSD SAYOS USLSL SAPRS LGSYU SLNSD PSOSA 
LRSAA SLYUS YRSLD USLOS YGLSL SLONS ALSDP SOSAU ASLLS YRYSY 
DSGSO = 


7. Diagnose the following, reconstruct all elements of the cryptosystem, and recover the plain text: 


SMFXB MNEIB ESLPR CMEXP UIKKS MCSRZ NBIWX FENFX PNBEI YZXBP 
QPJEC JSVZD LVCRA YYOZS ODAKV DLOCR AYJDA YMODD JZDVA ZDLOD 
QPTAK UIOCS XOKAH OXWTS PIFHS HIODH RUKOV OOEJH OXVSH FDOQZ 
UPYXL VTTJL VUXYP YZYPU OJXEI PVZXA PVSJY PVUVN IKOZS JYPVU 
XQLMJ UPJXM VEIDM JIAJG EICRR 


8. Diagnose the following, reconstruct al] elements of the cryptosystem, and recover the plain text: 


XXSDR RUFTS IRPIH ZENWK HSWPW ZIEWM VKHCK VFSBL GEMUW TDSPU : 
HTIKY ZGHKL UOWDD UYRNW QBJED AEMFC JSBWP IJGKB BUKUM DWDZP : 
GYOCT PDCKX UDFWC DHRTT DSGXR ZQVOT YOLUW FKWKW XAXVW FBYHM 
TCLVK MNCQH NCFBL UTZPY UMPDC XBKKC EQHBI GYNKV NULXX EMIQW 
VJFPD BPPZK QZATA DVBQZ ATRAF PCKDX 
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